Photography

Whenever individuals can be identified by their image, data protection legislation applies. In these situations, the rights of the individuals in the collection and use of their photographs must be respected – they must be informed when an identifiable image of them will be or has been captured, and a legal basis must be found before the image is used in any way.

There is one important distinction for photography:

• The actual photography which requires a legal basis
• Publishing your photo on the internet which constitutes international data transfer and requires a safeguard

Photographs of individuals and posed groups

When taking photographs of a specific person that you might want to publish on the internet, you can use ‘legitimate interest’, ‘consent’ and ‘contractual obligation’ as your legal basis.

The ICO recommends using ‘legitimate interest’ as this is the easiest legal basis as long as that is valid and used correctly.

If you use ‘consent’, then ensure that consent is validly collected and stored. Put this consent in writing. This provides added protection for limited administrative effort.

If children under the age of 13 years are clearly recognisable in an image, consent from a parent or guardian should be obtained.

All consent forms needs to be kept for the life that you hold the photo as evidence.

If a data subject withdraws their consent then the consent is still deemed to have been valid up to the point of withdrawal. The example the ICO gives is that if you had used a photo (on the lawful basis of consent) in your new prospectus and a data subject withdraws their consent, you do not need to take any action on all the prospectuses that you have sent out or distributed. You would, however, not be able to use any more of the thousands of copies of prospectuses you still have. If you had sent the proof to the printers and they had already started production, you would need to cancel production and probably pay all the associated fees. If the photograph is on display in a public area such as a photo board, it must be removed as soon as possible.

Taking and publishing photographs can also be part of a contract, for example of the keynote speaker at a conference.

In all three situations you must tell the data subjects what you intend to do with the photographs, including whether they will be published on the internet.

Photographs of crowds or groups

If crowd shots are taken during an event and an individual is not identifiable, then there is no need to find a legal basis to take, display or publish the photo. This applies to any individuals, students and staff whose images are incidental detail, such as in crowd scenes for graduation.

If the photos are taken at a conference where it is likely that individuals may be identified even in crowd scenes, then your legal basis is ‘legitimate interest’.

In both these scenarios, you must include notices at the event informing attendees of the following points:

• Alert people in the foreground of these shots who are within earshot of the photographer verbally and given the opportunity to move away if they wish.
• Give a warning in writing that photography will be taking place at the event.
• If you use a registration form, then this warning must be included in the form, you can also use notices displayed at events and
• Include a sentence about photography in printed programmes or publicity material.
• Provide a clear opt-out (e.g. speak to the photographer, wear a sticker /wristband, remove yourself from the photo areas, say no thank you if the photographer asks, or event don't attend the event). Obviously there can be practical challenges to this and there is a point where a photo is just scene shot and no-one is particularly identifiable. Evidence would need to be kept of the information that you provided to the data subjects (e.g. keep the email / the posters / the event form etc.).

If you take pictures of random groups of people, such as in general campus scenes, and there is a possibility that individuals might be identified when the images are posted on the internet, then your legal basis will be ‘legitimate interest’. In this situation, you will not have to provide a privacy notice.

Photographs of children

If taking photographs of children under the age of 12, you must obtain consent from a parent or guardian. This may be written or verbal depending on the circumstances, see the guidance above.

Photographs for ID purposes

Photographs are taken/provided by staff and students for identification purposes, as part of the University’s contract with them to ensure their safety and security and to prevent fraudulent activity (eg. exam or other identification). However, use of photographs beyond these purposes requires consent.

Photographs on intranet, internet or building notice boards

Intranets, Wikis, Sharepoint and building notice boards

Profile photographs of staff or students on School intranets, Wikis, SharePoint or other sites that are restricted to current UoE staff and students require consent. The same applies to profile pictures on building notice boards.

The consent form for the use of profile pictures on intranet and building notice boards can be found here:

Photographs on the internet

Publishing photographs of identifiable people on internet sites constitutes international data transfer, as the photos can be downloaded anywhere in the world, including in countries that don't have a data protection regime. That means you will require a so-called safeguard. The only possible safeguard here is 'consent to international data transfer'. If you want to publish photographs on the internet, you must obtain consent for the publication.

Note: your legal basis for taking photographs is still legitimate interest, as this consent is only consent to publish.

Individuals retain the copyright to their photographs and can withdraw consent at any time for their use

Use the template consent form below.

Template consent form

This is an example of a consent form staff can use. You must adapt it as appropriate to the circumstances.

Communications and Marketing have produced a privacy notice for photography and video which can be used alongside the consent form. The template for this privacy notice is available on the Privacy Notices page.

General guidance on international data transfer can be found here:

This article was published on 2023-11-09