The Data Protection Commissioner (DPC) has issued some guidelines in response to the large number of questions it receives from parents around whether it is ok to take photos at school communions, award ceremonies and sports events or whether GDPR prevents this. The kinds of questions being received include ““Do you need the consent of a child’s guardian before you can take a photo of a child?”, “Do you need consent for each separate school event?, Can schools ban parents from taking photos at school events?”,

According to the DPC, these type of activities fall “under the so-called “household exemption” under the GDPR, which provides that the GDPR does not apply when a person processes personal data (for example, a photograph of someone) in the course of a purely personal or household activity, e.g. with no connection to a professional, business, official or commercial activity.” In other words, taking a photo in public is generally fine; it’s what you do with that photo that can potentially become a data protection issue.

The authority also says that GDPR does not strictly prohibit posting photos taken at school events on social media either. However, it goes on to say that “if a parent published a photo of their child online that also contained images of other children, and the parent of one of the other children was uncomfortable with this and asked the parent to take the photo down, common sense and indeed common courtesy would suggest that you should take the photo down.

On the issue of whether schools can impose an outright school ban on photos being taken, the DPC says “While it is at the discretion of schools to create their own policies on these matters for closed school events, it may be rather difficult to enforce an outright ban – in the name of data protection – on taking photos at, for example, the school’s production of Grease the Musical which members of the public can also attend.”

The DPC also gives some useful guidelines for school’s where they are using the services of a professional photographer to take photographs at events or where a school might be publishing news letters with images of pupils. According to the DPC, “it’s important to note that in this context, schools are in a very different position to parents/family/friends in that they cannot rely on the household exemption. They are acting as data controllers which brings them into the sphere of the GDPR and all of the rules that come with it, for example they must have a legal basis to process the personal data (e.g. take and store photos) and they must provide clear and concise information about what it is that they are doing with this personal data, how long they will be keeping it for, etc.”

The full text of the DPC guidelines and observations can be read here

Comments