How to comply with data protection requirements when taking photographs and publishing photographs on the internet and internally?
Whenever individuals can be identified by their image, data protection legislation applies. In these situations, the rights of the individuals in the collection and use of their photographs must be respected – they must be informed when an identifiable image of them will be or has been captured, and a legal basis must be found before the image is used in any way.
Photographs of individuals and posed groups
When taking photographs of a specific person that you might want to publish on the internet, you can use ‘legitimate interest’, ‘consent’ and ‘contractual obligation’ as your legal basis.
The Information commisioner’s Office (ICO) recommends using ‘legitimate interest’ as this is the easiest legal basis as long as that is valid and used correctly.
If you use ‘consent’, then ensure that consent is validly collected and stored. Put this consent in writing using the attached consent form. This provides added protection for limited administrative effort. If children under the age of 13 years are clearly recognisable in an image, consent from a parent or guardian should be obtained (this may vary from country to country). The consent form needs to be kept for the life that you hold the photo as evidence. If a data subject withdraws their consent then the consent is still deemed to have been valid up to the point of withdrawal. The example the ICO gives is that if you had used a photo (on the lawful basis of consent) in your new prospectus and a data subject withdraws their consent, you do not need to take any action on all the prospectuses that you have sent out or distributed but you would not be able to use any more of the thousands of copies of prospectuses you still have. If you had sent the proof to the printers and they had already started production, you would need to cancel production and probably pay all the associated fees. If the photograph is on display in a public area such as a photo board, it must be removed as soon as possible.
Taking and publishing photographs can also be part of a contract, for example, the keynote speaker at a conference.
In all three situations, you must tell the data subjects what you intend to do with the photographs, including that they will be published on the internet.
Photographs of crowds or groups
If crowd shots are taken during an event and an individual is not identifiable, then there is no need to find a legal basis to take, display or publish the photo. This applies to any individuals, students and staff whose images are incidental detail, such as in crowd scenes for graduation.
If the photos are taken at a conference where it is likely that individuals may be identified even in crowd scenes, then your legal basis is ‘legitimate interest’.
In both these scenarios, you must include notices at the event informing attendees of the following points:
- Alert people in the foreground of these shots who are within earshot of the photographer verbally and given the opportunity to move away if they wish.
- Give a warning in writing that photography will be taking place at the event.
- If you use a registration form, then this warning must be included in the form, you can also use notices displayed at events and
- Include a sentence about photography in printed programmes or publicity material.
- Provide a clear opt-out (e.g. speak to the photographer, wear a sticker /wristband, remove yourself from the photo areas, say no thank you if the photographer asks, or event don’t attend the event). Obviously there can be practical challenges to this and there is a point where a photo is just scene shot and no-one is particularly identifiable. Evidence would need to be kept of the information that you provided to the data subjects (e.g. keep the email / the posters / the event form etc.).
If you take pictures of random groups of people, such as in general campus scenes, and there is a possibility that individuals might be identified when the images are posted on the internet, then your legal basis will be ‘legitimate interest’. In this situation, you will not have to provide a privacy notice.
Note: If you upload photographs of identifiable persons onto the internet, you very likely have an international data transfer. Please consult the guidance on International Data Transfer.
International data transfer guidance
Photographs of children
If taking photographs of children, you can use ‘legitimate interest’ or you must obtain consent from a parent or guardian. This may be written or verbal depending on the circumstances, see the guidance above.
Source: https://www.ed.ac.uk/
Principles for media reporting on children
Six principles
- Respect the dignity and rights of every child in every circumstance.
- In interviewing (and reporting on) children, pay special attention to each child’s right to privacy and confidentiality, to have their opinions heard, to participate in decisions affecting them and to be protected from harm and retribution.
- Protect the best interests of each child over any other consideration, including advocacy for children’s issues and the promotion of child rights.
- When trying to determine the best interests of a child, give due weight to the child’s right to have their views taken into account in accordance with their age and maturity.
- Consult those closest to the child’s situation and best able to assess it about the political, social and cultural ramifications of any reportage.
- Do not publish a story or an image that might put the child, their siblings or peers at risk, even when their identities are changed, obscured or not used.
Six guidelines for interviewing children
- Do no harm to any child; avoid questions, attitudes or comments that are judgemental, insensitive to cultural values, that place a child in danger or expose a child to humiliation, or that reactivate the pain of traumatic events.
- Do not discriminate in choosing children to interview because of their sex, race, age, religion, status, educational background or physical abilities.
- No staging: do not ask children to tell a story or take an action that is not part of their own history.
- Ensure that the child or guardian knows they are talking to a reporter. Explain the purpose of the interview and its intended use.
- Obtain permission from the child and his or her guardian for all interviews, videotaping and, when possible, for documentary photographs. When possible and appropriate, this permission should be in writing. Permission must be obtained in circumstances that ensure that the child and guardian are not coerced in any way and that they understand that they are part of a story that might be disseminated locally and globally. This is usually only ensured if the permission is obtained in the child’s language and if the decision is made in consultation with an adult the child trusts.
- Pay attention to where and how the child is interviewed. Limit the number of interviewers and photographers. Try to make certain that children are comfortable and able to tell their story without outside pressure, including from the interviewer. In film, video and radio interviews, consider what the choice of visual or audio background might imply about the child and her or his life and story. Ensure that the child would not be endangered or adversely affected by showing their home, community or general whereabouts.
Seven guidelines for reporting on children
- Do not further stigmatize any child; avoid categorizations or descriptions that expose a child to negative reprisals – including additional physical or psychological harm, or to lifelong abuse, discrimination or rejection by their local communities.
- Always provide an accurate context for the child’s story or image.
- Always change the name and obscure the visual identity of any child who is identified as:
– a victim of sexual abuse or exploitation
– a perpetrator of physical or sexual abuse
– HIV positive, or living with AIDS, unless the child, a parent or a guardian gives fully informed consent
– charged or convicted of a crime. - In certain circumstances of risk or potential risk of harm or retribution, change the name and obscure the visual identity of any child who is identified as:
– a current or former child combatant
– an asylum seeker, a refugee or an internally displaced person. - In certain cases, using a child’s identity (their name and/or recognizable image) is in the child’s best interests. However, when the child’s identity is used, they must still be protected against harm and supported in the event of any stigmatization or reprisals. For example:
– when a child initiates contact with a reporter, wanting to exercise their right to freedom of expression and their right to have their opinion heard
– when a child is part of a sustained programme of activism or social mobilization and wants to be identified as such
– when a child is engaged in a psychosocial programme and claiming their name and identity is part of their healthy development. - Confirm the accuracy of what the child has to say, either with other children or an adult, preferably with both.
- When in doubt about whether a child is at risk, report on the general situation for children rather than on an individual child, no matter how newsworthy the story.
Source: UNICEF https://www.unicef.org/eca/media/ethical-guidelines
More guidelines: Mediawise The Media and Children’s Rights‘