The General Data Protection Regulation (GDPR) prescribes that images and video recordings of individuals constitute personal data, and therefore falls within the GDPR; however, determining whether personal data is in images is not always clear-cut. Thus, the taxonomy of ‘crowds, small groups and individuals’ is used in this guidance note to differentiate scenarios.
While the guidance note below outlines an interpretation of when GDPR applies or not, it is pertinent to note that in all instances if an individual objects to their image being taken and/or published, we must reasonably consider this and where appropriate remove the image and/or any identifiers. This right is not absolute, and if we are not able to reasonably remove the image, we can refuse – e.g. an image has been published in textbooks and it would not be possible or reasonable to recall every copy to remove the image, then UCL can refuse the objection.
The guidance note below applies to images already existing on UCL databases, as well as for the future taking of images.
In all future instances, the persons being photographed/videoed must be made aware that this is happening, and for what purpose; this is best achieved through a Privacy Notice.
Where the image is of a crowd, this is unlikely to be personal data as the individuals will not be identifiable. The GDPR will not therefore apply.
This does not mean that you do not need to make announcements about the photography when crowd photography is being taken, and you should continue to follow UCLs guidelines on this.
If you are concerned about instances where individuals may request not to be recorded in larger events, you need to consider reasonable to attempt to achieve this e.g. the issuing of coloured lanyards which can then be used to identify those individuals who did not want their identity published in post-production.
- ‘Small Groups’
Images of small groups are likely to constitute personal data and must, therefore, be treated in accordance with data protection legislation.
Under the Data Protection Act (1998) it was commonplace to rely upon consent as the legal basis for processing. If the photography is being taken as part of UCL core business or where UCL is the data controller, then it is likely that UCL may process this data under legitimate interests, and therefore it will not be necessary to obtain the explicit consent of the data subjects in question.
Note: You must undertake the necessary review to determine the lawful basis for processing at the start of your project. If you have any doubts, a Data Protection Impact Assessment (DPIA) should be completed, and you should complete the ICO’s Lawful Basis for Processing Tool.
You need to satisfy yourself that the individuals were aware that their photographs would be taken and the context in which those photographs would subsequently be used by UCL.
The same principles as for small groups apply where the photo is of a single person. To process these images or to continue using existing images held by UCL, you will need to satisfy yourself that the individual was aware that their photograph would be taken and the context in which the photograph would subsequently be used by UCL.
- Right to object
While it is not always the case that you will need to get explicit consent of individuals to the use of small group/individual photos, those individuals in these categories have the right to object to the use of those photos – either before or at any time after the photo is taken.
If an individual has raised concerns before the photo is taken, you should not include them in the photo. Where objections are raised after the photo is taken then you should reasonably review this and unless you have special circumstance that means you require the photo and/or it is not possible to remove it (e.g. it has been published in a text book which has already been produced) then you should stop using the relevant photo and remove it.
- Where can I get further advice?
If you have any concerns about the level of Data Privacy risk, you should complete a DPIA.
If you are concerned about reconciliation action to meet this privacy risk, then please contact the Data Protection team
- Lecturecast recordings
UCL offers a lecturecast facility which is an automated system that allows the recording of lectures and then makes them available on the web as a learning resource.
While audiences are not normally filmed during lecture casts, if a recording is going to take place on the day you are in attendance, you are informed (normally verbally) prior to any recording taking place, the purpose of the recording and where it will be made available, rather than seeking explicit consent.
Sometimes there will be a notice outside the location where filming is to take place, so that those who do not wish to participate can avoid it.
Further information is available at:
updated 12 October 2018