On 20 Jun 2019, at 09:57, Frances Horrocks <[log in to unmask]> wrote:

Hi all,

I'm hoping someone may be able to point me in the right direction for two queries I'm hitting a dead end on (even tried ICO live chat to absolutely no avail):

1. A University department would like to publish on their website postcards sent to them by students on study trips. 

Lawful basis is legitimate interest of department in promoting activities to students and to public at large, and legitimate interest of all students in knowing about activities available and being able to network with each other (through existing channels, to share knowledge about travel).

Students would be able to request that their card isn't published, if they want. 

I'm struggling on the Privacy notice for this activity. How do you phrase the Security and International Transfers sections of the notice if you are publishing information? I can state what the University does to keep information safe, but fundamentally publishing means losing all control. I feel this needs representing, but I can't find any model examples for how to actually do this.

2. I'm also looking at requirements if publishing photos (e.g. student picture in prospectus, photo taken at an open evening on a University Twitter feed). 

From a DP perspective, I see no reason the lawful basis has to be consent, rather than legitimate interests with a nice easy opt out in advance, but historically photographers all seem to work on the basis of consent. I've found the Advertising Standards Authority information here: https://www.asa.org.uk/type/non_broadcast/code_section/06.html  which says you probably need permission to use photographs in marketing, but situation dependent.  Is there something I am missing here that means that consent is mandated?

Can anyone offer any thoughts?

Thank you so much

Frances 

--

Frances Horrocks    (pronouns she/her)

Information Governance Officer 

Legal Services 

Corporate and Information Services
University of York
Heslington
York YO10 5DD

 

  

Web: www.york.ac.uk/records-management/

Email disclaimer: http://www.york.ac.uk/docs/disclaimer/email.htm

I work flexibly - so whilst it suits me to email now, I do not expect a response or action outside of your own working hours.

For more on the General Data Protection Regulation and Data Protection Act 2018 see, https://www.york.ac.uk/records-management/dp/ 

---

All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html

Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):

• Leaving this list: send leave data-protection to [log in to unmask]
• Suspending emails from all JISCMail lists: send SET * NOMAIL to [log in to unmask]
• To receive emails from this list in text format: send SET data-protection NOHTML to [log in to unmask]
• To receive emails from this list in HTML format: send SET data-protection HTML to [log in to unmask]

All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html and are sent in the body of an otherwise blank email to [log in to unmask]

Any queries about sending or receiving messages please send to the list owner [log in to unmask]

(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)

---