17. Photography and Film
Download this section as a print-friendly PDF document.
Photographs and other digital images of identifiable living individuals are personal data and therefore subject to the principles of the Act, except where photographs are being taken strictly for personal use.
Where consent is required this must be freely given at the time the image is taken and only after the subject has been informed of the specific purposes for which their image will be used. Guidance on the different methods of obtaining consent will depend on the type of image to be taken and any limitations on its use. The relevant consent forms are available at 17.10 below.
This means that images will be available worldwide. In view of the very widespread nature of the disclosure and the effect upon the privacy of the individual, consent for publishing photographs on the internet is required from the subject. It is important to be aware that consent will not be considered as valid by the UK Information Commissioner unless it has been clearly explained to the individual that their images will be available throughout the world, including in countries outwith the European Economic Area (EEA) where their rights are not protected by UK law.
If photographs are to be taken of a crowd of people, consent does not need to be obtained if none of the members of that crowd can be readily identified from the photograph. By choosing angles carefully it is possible to avoid recognisable individuals e.g. by using low angles, backs of heads, blurred or out of focus images. If any one person should become the focus of a crowd scene then where appropriate and feasible they should be asked for their consent in writing. If this cannot be obtained or is not given and measures are not taken to make the individual unidentifiable, the photograph should be deleted immediately.
Where photographs are to be taken of a large group e.g. a lecture then this should be announced in advance so that individuals may leave the venue briefly if they do not wish to appear in the photographs.
When a smaller group of people is to be photographed e.g. those attending a seminar, then the participants should be given the option of leaving briefly as in 17.4 above or the informed consent of each member of that group should be obtained. Where it is not practical to do this verbal consent should be sought.
Informed written consent must be obtained when taking photographs of a specific person. This must includes all forms of intended use of the images including publication on the world wide web, in multimedia presentations or printed material.
If the photograph is to be used at a later date for a purpose which has not previously been specified, consent must be obtained from the individual for this new purpose.
Please note that consent for photographs of subjects under the age of 18 must normally be sought from and given by a parent or guardian.
Where a University event is being organised at which photographs are to be taken by in-house photographers or an external agency, there are some measures which should be taken to ensure that individuals are aware that photographs will be taken and the reasons for this. These include:
- if tickets are being issued this information can be printed clearly on the reverse
- a pro forma display notice should be prominently displayed
- a reference to photography could be included in any online announcements or programmes to be used at the event
Wherever practicable and appropriate it should be considered whether consent is to be sought. Where external agencies are employed they should be informed of the University's policy and given a copy of this Guidance. There is also a checklist which should be used for any special or unusual events.
17.9 Third Party/External Photographers
If an external/third-party photographer is going to be used to take photographs of individuals for the University then a data-sharing arrangement must be set-up with them. External photographers have to give us assurances regarding the processing/sharing of personal data and that all images/data will be kept/processed securely by them, transmitted/transferred securely and removed entirely from all equipment used to process personal data. They also need to provide retention periods and information about security measures applied to personal data.
Please see Section 8 of the Data Protection Code of Practice for more information on data sharing and contact the Information Governance Manager for information and guidance on setting up a data-sharing agreement.
Images and any associated forms must be kept securely whether in electronic or manual format in accordance with the DPA 1998 and the University's Information Security Policy and Manual Data Security Policy.
In addition, since the University must be able to comply with an individual's right to access their personal data, those taking photographs must ensure that any such requests can be dealt with promptly. The University's photographers have created a central database for this purpose and all those taking photographs on behalf of the University should send to them by the most secure method a completed copy of the consent forms together with a disk of any photographs, so that they may be catalogued and stored securely.
This is available from the University photographers.