Our approach to photography for marketing purposes reflects the requirements under UK GDPR. You must follow this process where you do not hold a legal basis to take images. Photography includes the taking of any still or moving images in which any person can be identified by any other person.
Request consent forms before any photography takes place
The photo shoot organiser must ensure participants complete a consent form before any photography begins. This must not be delegated to photographers (unless they are an Essex County Council (ECC) employee).
Case law allows children aged 13 years old and older, with the capacity to understand the notion of consent, to sign their own consent form.
Types of consent forms
There are two types of consent form, one for individuals and one for schools/groups.
Consent forms are requested online and you will need to state the name and location of the event as well as the date:
Why consent forms are important
The consent form is important as:
- it provides evidence that we hold consent
- it includes a unique reference number (URN) which enables us to locate images should an individual wish to withdraw consent
- the individual’s rights under UK GDPR are explained
- it provides evidence that ECC is complying with UK GDPR by ensuring individuals can exercise their rights
When you receive your consent form you will also receive consent cards (also known as withdrawal slips). These cards must be given to the individuals who have signed the consent forms. They include the contact details to withdraw consent and the URN from your consent form. Again, this ensures we comply with an individual’s rights under UK GDPR to withdraw consent so we can use the URN to trace the photoshoot owner.
What to do when a school signs a consent form
If a school has signed a school consent form, they should confirm they have received parental consent for ECC to take images of every child taking part in the photo shoot. You don't need evidence of this though. It's the school's responsibility as the child is in their care.
What to do at large public events
In the case of a large public event, you can use a Poster (PDF, 488 KB) and accompanying Handout (PDF, 209 KB). You must include your contact details on the poster and handout. You must also have printed copies of the handout available in case of requests for further details. You must document, and save with the images, the following information:
- why you took the decision not to use individual consent forms
- what steps you took to inform individuals about photography taking place, for example multiple copies of the poster placed at strategic points at the event
- how you informed individuals of their rights under GDPR (PDF, 137KB)
- how you informed individuals who to contact if they do not want to be photographed
Pay attention to backgrounds
You must be mindful that the background of a photograph can change the context of the image and be classed as processing special categories of personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. For more information about processing special categories, see the working with personal data page.
Save your images in a restricted folder
The photographer should return images directly to the photo shoot organiser. Both images and the completed, scanned consent form must be saved in a restricted access folder. Please destroy the original hard copy form using confidential waste bins. Only those people who need access to the images should have access to the restricted folder. Restricted folders can be set up via a service request through the Assyst portal.
Tracking usage
It is important to record where each image is used, in order to ensure we comply with UK GDPR and the right of the individual to withdraw their consent. Tracking enables you to provide details, if asked, to explain how you have used an image and to delete those images when consent is withdrawn.
This tracking must be undertaken by the photoshoot organiser or their nominated delegate. It also makes it easier for you to track when an image is due to expire. The Personal information tracker (XLS, 18 KB) will help you to track usage. Note, this template was reissued on 1 April 2021 as you are no longer required to state a child’s date of birth and age.
Retention and deletion
The council retains images for five years. Images must be deleted when:
- a person withdraws their consent
- the consent expires after five years
The photo shoot organiser (or nominated delegate) is responsible for deleting images. Deleting an image requires you to:
- delete the image from the restricted folder
If you have any queries please contact the Design Studio. For queries about your responsibilities under GDPR, see the UK GDPR page.