I want to use video, sound-recordings, and photographs

If you will be capturing information via video, sound recording, or photograph, you must:

• Determine if the images or recordings to be captured will be personal data.  Can individuals be identified, either directly, or indirectly by combining it with other information?
• If you decide you will be capturing and using (processing) personal data, you will need:
  • To tell individuals what you will be doing, and why (you should make a privacy notice available, to explain in detail how their personal information will be used, and what their rights are); and
  • You must identify the lawful basis you will use to process their personal information in accordance with data protection law.
• Ensure the personal data (photographs, video or voice recordings) must be kept secure.
• Determine how long to keep the information for, and when and how to dispose of it?

For general university business

Lawful basis available: Legitimate interest (preferred option)

To meet the requirements of the lawful basis:          

• Tell individual’s they may be recorded or photographed, it’s best to do this before and during the event,
• Do not use images or recordings in ways the person wouldn’t reasonably expect,
• You should assess whether the interests of the purpose you are using images or recordings for, are outweighed by the interests and fundamental rights and freedoms of individual, which require the protection of their personal data; and
• Recordings cannot subsequently be used, without consent, for purposes that are incompatible with the original purpose the information was captured for.

Lawful basis available: Consent (avoid, unless no other lawful basis applies)

To meet the requirements of the lawful basis:

• Consent must be a free choice, for a specific purpose, and you must tell the person what it will be used for and why,
• It must be a positive action to opt-it,
• If the person changes their mind and withdraws their consent, you must destroy their personal information; and
• You must record and keep evidence of their consent.

For employment or student admin (ID badge)

Lawful basis available: Necessary for a contract, or to enter into a contract

To meet the requirements of the lawful basis:

• When an employee or student leaves the university and you no longer need to keep the information, it must be destroyed,
• Privacy information must be published explaining how the university collects, uses, and shares personal information; and
• Systems used to capture and manage identity information must be secure and access restricted.

For research

Lawful basis available: Task in the public interest     

To meet the requirements of the lawful basis:

• The University Charter and Education Reform Act, demonstrates we meet the requirements of this lawful basis for research; and
• Privacy information must be published explaining how the research project collects, uses, and shares personal information.

Lawful basis available: Legitimate interest    

To meet the requirements of the lawful basis:

• Used for commercial research projects,
• You should assess whether the interests of the purpose you are using images or recordings for, are outweighed by the interests and fundamental rights and freedoms of individual, which require the protection of their personal data; and
• Privacy information must be published explaining how the research collects, uses, and shares personal information.
• The University Charter and Education Reform Act, demonstrates we meet the requirements of this lawful basis for research; and
• Privacy information must be published explaining how the research collects, uses, and shares personal information.

For online meetings /lecture capture

Lawful basis available: Task in the public interest

To meet the requirements of the lawful basis:    

• The University Charter and Education Reform Act, demonstrates we meet the requirements of this lawful basis for research; and
• Privacy information must be published explaining how the research collects, uses, and shares personal information.      

Lawful basis available: Legitimate interest    

To meet the requirements of the lawful basis:

• Clear information must be given in advance about the nature and purpose of the recording, usually via the staff/student privacy notices,
• You should assess whether the interests of the research project are outweighed by the interests and fundamental rights and freedoms of human participants, which require the protection of their personal data; and
• Recordings cannot subsequently be used, without consent, for purposes that are incompatible with those for which they are made.

For personal use

Lawful basis available: Not applicable

To meet the requirements of the lawful basis:

• Data protection law does not apply to the processing of personal data by an individual for a purely personal use.

Sensitive personal 'special category' data

The processing of photographs should not systematically be considered to be processing of special categories of personal data, they are covered by the definition of biometric data (a special category), only when processed to uniquely identify or authenticate a living person. Such personal data should not be processed, unless processing is allowed in specific cases set out in UK data protection law.

Childrens' data

Data protection law covers personal data belonging to children and adults. However, children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the capture and use of their personal data. Extra care is required to protect childrens' personal data.