17. Photography, Film and Recording
Photographs and other digital images of identifiable living individuals are personal data and therefore subject to the principles of the data protection legislation, except where photographs are being taken strictly for personal use.
17.1 Consent
Where consent is required this must be freely given at the time the image is taken and only after the subject has been issued with a privacy notice. Guidance on the different methods of obtaining consent will depend on the type of image to be taken and any limitations on its use. The relevant consent forms are available at 17.10 below.
There are a variety of ways in which consent can be requested and recorded.
- An individual consent form can be completed and signed by the individual
- Consent can be sought at the time individuals sign up for an event
- Take a photo of the individual holding a completed consent notice (example in 7.11)
- Take a photo of the group holding a consent notice
Records of consent must be kept securely at all times and stored in a relevant filing system within the University network or manual filing system and the applicable retention period applied. Record/filing systems must be kept in such a way that the records are destroyed when the retention period is met - generally 5 years for images, unless they are retained for archive/historical purposes and retained indefinitely and 10 years for consent forms.
17.2 Publication on the internet
This means that images will be available worldwide. In view of the very widespread nature of the disclosure and the effect upon the privacy of the individual, consent for publishing photographs on the internet is required from the subject. It is important to be aware that consent will not be considered as valid by the UK Information Commissioner unless it has been clearly explained to the individual that their images will be available throughout the world, including in countries outwith the European Economic Area (EEA) where their rights are not protected by UK law.
17.3 Crowd/General photographs
If photographs are to be taken of a crowd of people, consent does not need to be obtained if none of the members of that crowd can be readily identified from the photograph. By choosing angles carefully it is possible to avoid recognisable individuals e.g. by using low angles, backs of heads, blurred or out of focus images. If any one person should become the focus of a crowd scene then where appropriate and feasible they should be asked for their consent in writing. If this cannot be obtained or is not given and measures are not taken to make the individual unidentifiable, the photograph should be deleted immediately.
17.4 Large group photographs
Where photographs are to be taken of a large group e.g. a lecture then this should be announced in advance so that individuals may leave the venue briefly if they do not wish to appear in the photographs. A photograph of the group holding the consent form can be retained as a record that consent was obtained.
17.5 Smaller group photographs
When a smaller group of people is to be photographed e.g. those attending a seminar, then the participants should be given the option of leaving briefly as in 17.4 above or the informed consent of each member of that group should be obtained. As above, a photograph of the group with each individual holding up their consent form can be retained as a record that consent was sought and obtained.
17.6 Individual photographs
Informed written consent must be obtained when taking photographs of a specific person. This must includes all forms of intended use of the images including publication on the world wide web, in multimedia presentations or printed material.
If the photograph is to be used at a later date for a purpose which has not previously been specified, consent must be obtained from the individual for this new purpose.
17.7 Subjects under the age of 18 and vulnerable persons
Please note that specific consent for photographs of subjects under the age of 18 must be sought from and given by a parent or guardian. A child is defined as anyone under the age of 18, in accordance with the UN Convention on the Rights of a Child.
Generally, it is advised to avoid taking personally identifiable images of children. Take images from behind, capturing only the backs of heads and choose angles carefully, as per the advice for crowd shots.
17.8 Event photography
Where a University event is being organised at which photographs are to be taken by in-house photographers or an external agency, there are some measures which should be taken to ensure that individuals are aware that photographs will be taken and the reasons for this. These include:
- if tickets are being issued this information can be printed clearly on the reverse
- a pro forma display notice (see 17.11) should be prominently displayed e.g. at the entrance to the event, at the sign-in table, etc. Photographs of the signs in context e.g. so you can see where they were displayed should be kept as a record of their use
- a reference to photography should be included in any online announcements or programmes to be used at the event
- a brief statement about photography should be included in house-keeping announcements at the beginning of the event
Where external agencies are employed they should be informed of the University's policy and given a copy of this Guidance. There is also a checklist which should be used for any special or unusual events.
17.9 Third Party/External Photographers
If an external/third-party photographer is going to be used to take photographs of individuals for the University then a data-sharing arrangement must be set-up with them. External photographers have to give us assurances regarding the processing/sharing of personal data and that all images/data will be kept/processed securely by them, transmitted/transferred securely and removed entirely from all equipment used to process personal data. They also need to provide retention periods and information about security measures applied to personal data.
Please see 
Section 8 of the Data Protection Code of Practice for more information on data sharing and contact the Information Governance Manager for information and guidance on setting up a data-sharing agreement.
17.10 Storing the images and forms
Images must be removed from the camera/s and stored securely in University systems (preferably password protected on the IT network) as soon as possible after being taken. Images must NOT be retained on the camera.
Images and any associated forms/consent photos must be kept securely whether in electronic or manual format in accordance with the data protection legislation and the University's 
Information Security Policy and
Manual Data Security Policy.
In addition, since the University must be able to comply with an individual's right to access their personal data, those taking photographs must ensure that any such requests can be dealt with promptly e.g. filing systems for storing these records must be set up in such a way that the photos can be easily found when required and destroyed when they have reached the end of their retention period. The University's photographers have created a central database for this purpose and all those taking photographs on behalf of the University should send to them by the most secure method a completed copy of the consent forms together with a disk of any photographs, so that they may be catalogued and stored securely.
17.11 Consent forms and Further Information and Guidance
This is available from the 
University photographers.
General consent form 2020
Film and photo display notice 2020
Under 18 consent form 2020
Image Library privacy notice
Sample consent photo
17.12 Recording online meetings and events
Page last updated 15 October 2020