The Data Protection Commissioner has issued new guidelines on taking photos at school events.

It comes after a number of schools banned photos at communions, confirmations and sports days.

The schools have warned parents that taking the photos could leave them in breach of the new GDPR regulations.

However, the Data Protection Commissioner (DPC) has said that things are not necessarily that simple.

In a blog post it said the GDPR regulation do not “provide an exact roadmap on when it’s permissible to take and publish photographs in the context of school events.”

It said that a “balanced, common sense approach” will help ensure that individual’s rights are respected while also ensuring GDPR does not prevent people capturing and celebrating significant school events.

GDPR

It said there is nothing under the new privacy rules stopping people from taking pictures in public.

“Provided you’re not harassing anyone, taking photographs of people in public is generally allowed,” it said in blog post.

“However, whether you can publish a photograph to a broad-based audience is a different question.

“In other words, taking a photo in public is generally fine; it’s what you do with that photo that can potentially become a data protection issue.”

"Household exemption"

It said that families are allowed to take photos at families events due to the so-called “household exemption” of the GDPR regulations.

It means that GDPR does not apply to photos taken in a personal capacity – with no connection to any commercial activity.

GDPR also does not strictly ban families from posting those photos to social media.

“However, if a parent published a photo of their child online that also contained images of other children – and the parent of one of the other children was uncomfortable with this and asked the parent to take the photo down – common sense and indeed common courtesy would suggest that you should take the photo down,” said the DPC.

Official photos

However, schools that take official photos at the events for use on websites, newsletters and newspapers are in “a very different position” to parents, families and friends.

The DPC said: “They are acting as data controllers which brings them into the sphere of the GDPR and all of the rules that come with it.”

It means schools must provide clear and concise information about what they are the photos are going to be used for and by whom, where the photos are likely to appear and how long they will be keeping them for.

Consent

Schools are obliged to get a parent’s consent for taking and publishing a photo of a child – and that consent must be “freely given, specific, informed and unambiguous.”

Parents are entitled to withdraw their consent at any time – although that does not affect the way the photos were used in the past.

It warned that schools should not overlook the consent of children and young people themselves – and should make a judgement call as to the age at which they are capable of agreeing and giving consent themselves.

Parents and children should be involved in those discussions.