Close
Guidance note on the use of images and videos under data protection law. Version 2, published 4th April 2019
This guidance covers the use of images of people, including photos and videos, for UCL’s own purposes. It applies to images already stored on UCL databases, as well as to images captured in the future. The use of images in the context of Lecturecast is also considered.
- Scope
This guidance covers the use of images of people, including photos and videos, for UCL’s own purposes. It applies to images already stored on UCL databases, as well as to images captured in the future. The use of images in the context of Lecturecast is also considered.
Images taken for personal use only are exempt from data protection law, e.g. photographs taken by family members at a graduation ceremony.- Images and personal data
Personal data means any information relating to an identified or identifiable individual.
If an image can be used to identify a living individual, that image is therefore likely to constitute personal data. This includes where individuals in an image are named, and also covers situations where no names are used but other contextual information would enable individuals to be identified, e.g. a caption specifying the year and degree subject that is attached to an image of a small group of UCL students.
Determining whether a particular image includes personal data is not always straightforward. This note therefore provides guidance on whether the following types of images are likely to be classed as personal data:
- Images of individuals
- Images of small groups; and
- Images of individuals.
- Other issues to consider
Further issues you will need to consider in relation to the use of images include:
Where personal data is processed, the appropriate legal basis for processing. Note that this will generally be UCL’s legitimate interests, meaning that consent will not be required. Please see here for further information on the legal basis for processing and legitimate interests. In particular, when relying on legitimate interests, you will need to complete a ‘legitimate interests assessment’ form;
How best to provide privacy information, including making people aware that they are being photographed/videoed and the purposes for which the images will be used. For the purposes of data protection law, it is best to provide privacy information to individuals through a Privacy Notice. Further guidance is provided on this point below; and
The right to object. Under data protection law, where personal data is processed by UCL, e.g. in relation to small group/individual photos, the individuals in those images will have the right to object to the use of their personal data, either before or at any time after the image is captured. If an individual has raised concerns before the photo is taken, you should not include them in the photo. Where objections are raised after the photo is taken then you should send the request to the data protection team at data-protection@ucl.ac.uk. The data protection team will consider the request and, where appropriate, remove the image and/or any identifiers.
Even where no personal data is processed, UCL’s guidelines on informing people that images will be captured and providing them with a way of opting out of being included in photographs and videos of large events.
- Images of crowds
Where the image is of a crowd and does not focus on one individual or a group of individuals, it is unlikely to be personal data as the individuals will not be identifiable. Data protection law will not therefore apply.
This means that:
You will not need to establish a legal basis for processing personal data. In particular, consent will not be required;
There is no requirement to provide privacy information to all individuals in the image. However, even in relation to crowds, UCL’s policy is that individuals should still be informed that photographs or videos are being taken. You should therefore consider making announcements about photography/videos at events and put up signs to inform event attendees that images will be captured by UCL.
As no personal data is being processed by UCL, individuals cannot object to the use of their personal data. However, it is UCL’s policy to respect the preferences of individuals who request not to be recorded in larger events. This means that you will need to consider taking reasonable steps to achieve this e.g. the issuing of coloured lanyards which can then be used in post-production to identify those individuals who did not want to be included in any images.
- Images of small groups
Images of small groups are likely to constitute personal data and must therefore be treated in accordance with data protection legislation.
This means that:
You will need to establish a legal basis for processing personal data. You should rely on UCL’s legitimate interests where possible and consent will not be required;
You must provide individuals with privacy information, making sure that they are aware that their images would be taken and the context in which those images would subsequently be used by UCL; and
You must be prepared to receive objections from individuals to the use of their personal data.
- Images of individuals
An image of a single individual is likely to be classed as personal data and the same principles applicable to images of small groups will apply. This means that:
You will need to establish a legal basis for processing personal data. You should rely on UCL’s legitimate interests where possible and consent will not be required;
You must provide the individual with privacy information, making sure that they are aware that their image would be taken and the context in which their image would subsequently be used by UCL; and
You must be prepared to receive objections from the individual to the use of their personal data.
- Lecturecast recordings
UCL offers a Lecturecast facility which is an automated system that allows the recording of lectures and then makes them available on the web as a learning resource.
While audiences are not normally filmed, if a recording is going to take place on the day you are in attendance, you are informed (normally verbally) prior to any recording taking place, of the purpose of the recording and where it will be made available. Explicit consent is not sought from individuals.
Sometimes there will be a notice outside the location where filming is to take place, so that those who do not wish to participate can avoid it.
Further information is available at: Lecturecast.
- Where can I get further advice on the issues raised in this note?
If you have any concerns that your use of images could pose a risk to the rights of individuals, including in relation to privacy, then you should complete a DPIA.
Please contact the Data Protection team for further advice and guidance on the issues raised in this note.
