I wouldn't have said that marketing was a main task of a university. Teaching, learning and research, yes, but not marketing.
Regards,
Peter Dinsdale
Data Protection Consultant
Perfect Image /
T: 0191 238 0111
www.perfect-image.co.uk
Follow us on Twitter http://twitter.com/perfectimage
-----Original Message-----
From: This list is for those interested in Data Protection issues <[log in to unmask]> On Behalf Of Bright, Tom
Sent: 11 December 2018 15:30
To: [log in to unmask]
Subject: Re: [data-protection] Consent to use images
Please could somebody clarify why the ICO has suggested that a university is able to rely on legitimate interests in the circumstances described below as I understood that public authorities were only able to rely on legitimate interests for a reason 'other than performing their tasks as a public authority'.
Is it felt that photographs for marketing purposes is not part of a university's public authority tasks? Find this hard to believe as surely marketing materials are to attract students, i.e. the main task of a university.
I understand that universities and FE/HE institutions are identified as public authorities in Schedule 1 Part 4 of the Freedom of Information Act 2000.
Consequently I have used legitimate interest rarely as a lawful basis at ECC but if someone can explain why I can consider using it more widely that would be appreciated.
Tom Bright
Data Protection Officer
East Coast College
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Clare Price
Sent: 11 December 2018 14:20
To: [log in to unmask]
Subject: Re: [data-protection] Consent to use images
I spoke to the ICO about this on the phone a couple of weeks ago to get clarity on our situation of being a university who takes photos of people including student teachers and the children they teach including for use in marketing materials. They confirmed that consent is a valid lawful basis for photography if the consent is validly collected, stored etc. But they recommended using legitimate interests as they feel as long as that is valid and done properly then it is simpler.
If you get consent the evidence of that consent needs to be kept for the life that you hold the photo. If a data subject withdraws their consent then the consent is still deemed to have been valid up to the point of withdrawal. The example the ICO representative gave was that if we had used a photo (on the lawful basis of consent) in our new prospectus and then a data subject withdraws their consent, we do not need to take any action on all the prospectuses that we have sent out or distributed but we would not be able to use any more of the thousands of copies of prospectuses we have printed. Or even worse, if we had sent the proof to the printers and they had already started production we would need to cancel production and probably pay all the associated fees. We could remove the page from the already printed prospectus, but presumably that page would have important course info on it, and they said a sticker over the photo in question would not be sufficient.
With legitimate interest you still need to inform the data subjects that photography is taking place (e.g. posters up, a notice on the event booking form, or an email beforehand, notice on the website or preferably a combination of the above) and you need to provide a clear opt-out (e.g. speak to the photographer, wear a sticker /wristband, remove yourself from the photo areas, say no thank you if the photographer asks, or event don't attend the event). Obviously there can be practical challenges to this and there is a point where a photo just because a scene shot and no-one is particularly identifiable. Evidence would need to be kept of the information that you provided to the data subjects (e.g. keep the email / the posters / the event form etc.).
As a result of the conversation we are going to be moving towards legitimate interests for all photos on campus. The ICO said there is no difference in law in this context between adults and children. But that whatever you do you need to do it properly and have demonstrable processes (e.g. how we manage consent and keep evidence of that consent for the lifetime of the photo or how to manage legitimate interests including informing the data subjects (or in the case children, the data subjects and their parents/guardians/accompanying adults)). Note if you have previously used consent then you need to be able to evidence that - you cannot just claim they were taken under legitimate interests. We are now going to delete a lot of old photos for which we are no longer storing consent and build up new reserves of photos taken under legitimate interests.
Jude Sloan
DPO and DP Project Coordinator
Newman University
Birmingham
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com ______________________________________________________________________
________________________________
Save paper, please think twice before printing this email.
Equinox House | Cobalt 3.2 | Cobalt Business Park | Silver Fox Way | North Tyneside | Newcastle upon Tyne | NE27 0QJ
T. 0191 238 0111 | F. 0191 238 0127 | Service Desk Direct Line. 0191 238 0121
Perfect Image Ltd. Registered in England & Wales. Company Registration Number: 2650067
Registered Office: Equinox House, Cobalt 3.2, Cobalt Business Park, Silver Fox Way, North Tyneside, Newcastle upon Tyne, NE27 0QJ
This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not represent those of Perfect Image Ltd. If you are not the intended recipient, please notify us at [log in to unmask] and be advised that you have received this mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
