Photography and the use of images in school and recreational activities

Children at Reykjavík City Department of Education & Youth workplaces have legal rights to privacy and data protection.
The Data Protection Act No. 90/2018 defines personal data as any identified or identifiable information about a data subject. This includes information that can be directly or indirectly traced to a specific individual, living or deceased. An individual is identifiable if they can be recognized, directly or indirectly.

Photos and videos can be personal data if the person in the image is recognizable and the content provides information about them. Taking, using, sharing, and publishing photos or videos can be considered processing of personal data. This falls under the Data Protection Act and must meet its requirements.

The Department of Education & Youth's authority to process personal data through photos and videos sometimes relies on informed parental consent, as per Article 9.1 of the Data Protection Act.

Taking and using photos for school information systems, (Mentor, Námfús, Vala Leisure, or Vala Preschool), children's lockers, and educational projects is based on legal obligations under Article 9.3. In rare cases, parental consent may be required.

Photos used for staff preventing life-threatening conditions like severe allergies or epilepsy are based on legal obligations and vital interests under Articles 9.3 and 9.4 of the Data Protection Act.

When sharing information about children electronically, use software that ensures control over shared personal data. Facebook and similar platforms do not meet these requirements. Information must not be shared with unauthorized parties, processed for other purposes, or compromised in safety. Always verify beforehand that processing is permitted under the Data Protection Act. Workplaces are not responsible for photos taken by parents or relatives.

Personal data must be processed lawfully, fairly, transparently and securely, and only as necessary. All handling must follow good data processing practices and meet basic requirements of Article 8 of the Data Protection Act.

Photographing children at play or work requires permission from the workplace administrator or supervisor. The same applies to publishing images.

When parental consent is required, parents1 have the authority to give consent for processing information about their children who are minors. Before obtaining consent, the workplace administrator must fully inform the data subject (parents) about photo taking and processing, including purpose and recipients. Otherwise, photo use violates data protection laws.

The parental consent form must meet these conditions. Photos cannot be used beyond the scope of consent. New uses require informing parents and obtaining special consent. Revoking consent does not affect the legality of prior photo taking and publishing. Unless revoked, consent remains valid while the child is enrolled in preschool, primary school, after-school programs, school bands, etc.

1 A parent is a person with custody of a child according to the Children’s Act.

Parents should always consult with their child about matters concerning them, as appropriate for the child's age and maturity.

Children have the right to express views on photos and publishing. The simplest approach is requesting consent from children based on age and maturity. Even young children may have opinions on discussions about them, or photos, which should be considered.

Photographing children at play or work requires permission from the workplace manager or supervisor. The same applies to publishing images.

School and recreational activity managers are responsible for photography and image publishing at their workplace. This includes complying with the Data Protection Act and other relevant laws and guidelines. Managers are responsible for obtaining informed parental consent when necessary.

Managers are also responsible for informing parents and children about photography and image publishing. They must ensure no photos are taken or published against the wishes of children or their parents.

Managers should respect the wishes of parents and children who do not want photos taken or published.

When planning to publish photos of children from school and recreational activities in printed materials, managers must inform parents and obtain their informed consent. This is covered in section 2 of these guidelines. This applies especially when publishing photos of one or two easily identifiable children.

Care and discretion

Care and discretion should always be exercised when taking photos and videos, and when using the images, in school and recreational settings in compliance with the Act on Data Protection and Act No 14/2012 on Information. The focus should be on the children's’ activities.

Respect

All photo and video shoots, and the use of the images whether it is on an open or private site, should be governed by the principle that children and young people should never be shown in a provocative, humiliating, or inappropriate manner, e.g. not taking pictures of naked children or children in vulnerable situations.

Anonymity

When releasing imagery, there is no mention of the name or other information except in special circumstances, such as when a child wins a prize or makes a public appearance on behalf of their school.

Children's right to self-determination

For all photo and video shoots, and the use of the images, the right to self-determination of children and young people should be respected. This means that their opinions must be duly taken into account according to their age and maturity, such as always requesting their oral consent for taking photos and videos, and for using the images.

Equality

When using images, care should be taken to ensure gender equality and that the proportion of girls and boys in images is as balanced as possible. Therefore, it a good practice to show group photos of children and youth in school and recreational activities seeking to reflect the diversity of the children, regardless of whether the images are hosted on an open or private website

Workplace equipment should be used

All photography of children in daily school and recreational activities should be carried out using a device owned by the relevant workplace of the Department of Education and Youth. Employees are not allowed to take photos and/or videos of children using their private devices.

School and recreational activity image collections must be stored in a closed area with controlled access. Social media is not considered a secure place to store school and recreational activity images. Access should be limited to staff who need it for their work.

Department of Education & Youth workplaces must transfer records according to the Public Archives Act, No. 77/2014. They cannot, therefore, delete documents and data they receive or create without permission from the National Archives of Iceland, based on records management rules or special provisions. This obligation includes transferring documents and data to the Reykjavík Municipal Archives. For images, selected material is transferred to the Reykjavík Municipal Archives, either as printed photos or in digital form.

Images should be transferred to the Reykjavík Municipal Archives when they are 20 years old, in line with Article 15 of Act No. 77/2014 on Public Archives and the Reykjavík Municipal Archives resolution.

Facebook and similar platforms

The Icelandic Data Protection Authority advises preschools, primary schools, after-school programs, sports clubs and other public or private entities working with children not to use Facebook or similar social media for sharing personal information about minors, whether general or sensitive.

The Authority reiterates this advice, directing schools and others working with children to avoid using Facebook or similar platforms for sharing personal information about minors, whether general or sensitive.

Sharing information about school and club events, activities, fundraisers, and announcements is not considered processing of personal data. These platforms may be used for such information.

The Authority generally does not object to Facebook photos of open school and club events that do not show sensitive situations or focus on individual children.

This applies to private social media pages and extends beyond photos to personal information in general. Instagram, Snapchat, YouTube, and Twitter fall into the same category as Facebook. Posting photos of individual children on these platforms is generally not allowed.

The Authority has not defined "open event" but suggests a broad scope for publishing everyday scenes without individual consent, such as photos of open school and club events that do not show sensitive situations. 3

School and recreational activities determine what qualifies as their open events. This may include public space events or where photos of groups are expected, such as festivals, sports events, public entertainments, presentations, or conferences. If parents object to photography or image sharing at school or recreational events, managers should consider these comments and respond if necessary.

Website of the workplace, open or password-protected.

For identifiable children in images not taken at open events, photography and website publishing are allowed if parents have signed a consent form. This applies even if the website requires a password.

Published promotional materials

For identifiable children in images not taken at open events, photography and publishing are allowed if parents have signed a consent form.

Images on workplace walls We assume group or class photos can be displayed on workplace walls. If children or parents object to photos on workplace walls, managers must review and decide on the matter.
Individual photos may be necessary in certain areas, such as cafeterias, for children with food allergies.

Class and individual photos

Many workplaces arrange student photo sessions for individual and class pictures. Professional photographers often handle these sessions, including setup and post-processing. Photographers typically upload photos to a secure website or cloud solution for parents to view before ordering.

Primary schools allow photography on their premises, connect parents with the photographer, and add individual photos to the workplace's digital information system (Mentor, Námfús, Vala Preschool, or Vala Leisure). Photographers are responsible for the session, post-processing, and safety. Parents should review the photographer's contract carefully before signing and ordering photos.

Parents usually receive access to their child's class photo area and can purchase class and individual photos. Parents get a password, limiting access to individual and group photos of their child's class. Photos are typically stored in low resolution, unsuitable for printing or other uses. Photo purchases are transactions between parents and the photographer. The photographer is responsible for recording and processing personal data related to the photo session and purchases, as defined by the Data Protection Act No. 90/2018.
Media Media access to workplaces in school and recreational activities requires managers’ approval. Media photography also requires managers’ approval. Publishing identifiable images of children taken in non-public areas or closed events requires signed parental consent forms.

Parents and individuals The Authority advises that workplaces generally cannot be responsible for content individuals post online themselves. However, workplaces are responsible for content they and their staff post online.
The Authority also advises that public institutions cannot ban individuals from photographing their own children. The Data Protection Act does not apply to an individual's handling of personal information solely related to their private or family affairs, or intended only for personal use.

Workplace managers should regularly review their websites, such as at the start of each school year. They must remove images of children who are no longer at the workplace. These images were published with parental consent.

Parents should be notified well in advance of planned actions.

Images of a child published with parental consent cannot be used after the child leaves the workplace.

You may have the right to access the personal data that the City of Reykjavík processes. You may also have the right to object to the processing, have the information corrected, request that it be deleted, have the processing limited, and/or have the information delivered to you or a third party in machine-readable format. More information about these rights can be found in Reykjavík City's Privacy Policy.

Note that if you do not wish for Reykjavík City to process your personal data you can always contact the Reykjavík Data Protection Officer or send a message to the Icelandic Data Protection Authority (DPA).

Complaints regarding the processing of the Department of Education and Youth of individuals’ personal data can be submitted to the Reykjavík City Data Protection Officer personuverndarfulltrui@reykjavik.is. You can also contact the Service Center at 411 1111.

Any individual has the right to file a complaint with the Data Protection Authority if disputes arise regarding the processing of personal data in Department of Education & Youth activities. Information about the Icelandic Data Protection Authority.

Staff, parents and children will be informed of these guidelines.

These guidelines supersede the 2015 criteria for photography and image publishing in school and recreational activities and the brochure on the use of web and social media in youth center activities.

Approved by the Department of Education & Youth executive board on January 29, 2020.