Data Protection - Taking photos in school - The ICO's advice.

Have you suffered the wrath of an overzealous teacher, telling you can't take photos of your children at a school event? Have a look at the feedback from the Information Commissioners Office. Being married to a teacher and having a number of teachers in my family I'm sad to say that I've seen a number of over zealous Headteachers particularly in primary schools who get a little bit carried away quoting the data protection act at Parents, almost always incorrectly. It normally happens like this :- Parent whips out a camera to take a picture of little Johnny as he crosses the finish line at the school sports day. Headteacher comes running over citing all sorts of data protection related reasons why Parent can't take a photo of little Johnny. Parents get annoyed and frustrated, upset that the Headteacher is denying them the opportunity to take photos of the occasion. This kind of frustration is shared by many parents who unknowingly forego the opportunity to take photos/videos because of an over aggressive and ignorant application of the Data Protection Act. So... what does the Information Commissioners Office "ICO" actually have to say on the matter. Well as you might expect they have issued a specific guidance note on just this topic. A note that on occasion I have actually sent to headteachers so they are aware of what the rules are. "Recommended Good Practice The Data Protection Act is unlikely to apply in many cases where photographs are taken in schools and other educational institutions. Fear of breaching the provisions of the Act should not be wrongly used to stop people taking photographs or videos which provide many with much pleasure. Where the Act does apply, a common sense approach suggests that if the photographer asks for permission to take a photograph, this will usually be enough to ensure compliance. Photos taken for official school use may be covered by the Act and pupils and students should be advised why they are being taken. Photos taken purely for personal use are exempt from the Act." Yes you read that correctly. Photos taken purely for personal use are exempt from the Act. So what typically happens is a head assumes that because THE SCHOOL(!) may have data protection issues to deal with when taking photos of pupils and students, that those same rules may apply to Parents taking photos for personal use. The ICO guidance even gives specific examples for complete clarity. "Examples Personal use: A parent takes a photograph of their child and some friends taking part in the school Sports Day to be put in the family photo album. These images are for personal use and the Data Protection Act does not apply. Grandparents are invited to the school nativity play and wish to video it. These images are for personal use and the Data Protection Act does not apply. Official school use: Photographs of pupils or students are taken for building passes. These images are likely to be stored electronically with other personal data and the terms of the Act will apply. A small group of pupils are photographed during a science lesson and the photo is to be used in the school prospectus. This will be personal data but will not breach the Act as long as the children and/or their guardians are aware this is happening and the context in which the photo will be used. Media use: A photograph is taken by a local newspaper of a school awards ceremony. As long as the school has agreed to this, and the children and/or their guardians are aware that photographs of those attending the ceremony may appear in the newspaper, this will not breach the Act " The only way I think a school could enforce a no photo policy is if somehow the parents have signed up to it contractually. That is different and I am not a lawyer - there are plenty on Manchester Professional if you need someone to check a school on-boarding contract.. However if a Headteacher starts swinging the Data Protection Act at you and tells you to switch off your camera at least you know where you stand now. Guidance paper quoted can be downloaded from the Information Commissioner's Office here If you are struggling with Information security within your organisation and want to look at practical implementations of the data protection act, ISO 27001 or the PCI data security standard. Please feel free to get in touch : 07889 183 207 / andrew.barratt@ptpconsultingllp.com