Privacy Notice for Photography and Filming

Birmingham City University (BCU) is the data controller. You can contact our Data Protection Officer by emailing informationmanagement@bcu.ac.uk or by post to:

Data Protection Officer
Information Management Team
Birmingham City University
Floor 1, Joseph Priestley Building
6 Cardigan Street
Birmingham, B4 7RJ

The University may commission photography / filming on campus or at specific events, such as award ceremonies, careers fairs, celebratory events, concerts, courses, lectures, open days / taster days, performances, trips etc. for use in its internal and external promotional material or university archive material. Staff, students and members of the public may appear on the resulting images.

Data protection laws state that images (in the context of this document that means photographs / films) of identifiable individuals count as personal data, however it is not always simple to decide whether an image contains personal data. There is no numerical definition of a crowd, therefore professional judgement is required. Where the photograph is of a crowd, this is unlikely to be personal data as the individuals will not be identifiable and therefore data protection laws are unlikely to apply.

BCU is the data controller for photographs taken by the University for its core business use, or given to the University with permission for its core business use. Core business use includes supporting archiving, assessment, graduation, health and safety, identification checks, learning, marketing, professional development, research, security, student support and teaching.

As recommended by the supervisory body, the ICO, BCU is using the lawful basis of ‘legitimate interests’ for photographs including people, except for photography / filming identification and security purposes, health and safety purposes and learning, teaching and assessment purposes which are carried out ‘for the performance of contract’ (i.e. the legal relationship between a student and the University, staff member and University or contractor and University). A further exception is where people will be named in the photography / filming. In this circumstance the lawful basis is ‘consent’. Photos / filming of visitors on aspirational / progression to H.E. events (e.g. students from schools or colleges) where we have received their consent. We ask for consent in these circumstances to ensure that the people understand they may be photographed. 

Legitimate interests means we need to process the personal information to fulfil our objectives, we believe it will not adversely affect you and we think you would expect it. Where the lawful basis is legitimate interests or contract, people will not be asked for their consent. However, the University must make reasonable efforts to inform people that photography / filming is taking place. Notices (for example via email / Eventbrite / posters etc.) will be published to indicate that photography / filming is taking place. If the lawful basis is legitimate interests, people have the right not to appear in an identifiable way in photography / filming and can arrange for this by contacting the event organiser or the Data Protection Officer (informationmanagement@bcu.ac.uk). However, if there is no way to ensure that the person will not appear in the photography whilst at the event, it may result in the person choosing not to attend the event.

Where people’s special category data is included, for example if alongside a photo or in a film people are being named and quoted with a quote that includes special category data, the lawful basis is ‘consent’.

You have the legal right to request to ‘opt-out’ of appearing in a photo / film if the lawful basis is legitimate interests. The University will consider your request but is not obligated to grant it. Examples of how to opt-out include:

• reading signage to place yourself in a photography free zone (e.g. when photography is taking place in a lecture theatre).
• choosing to stand out of shot. If the shot encompasses a wide area you may choose leave the whole area.
• choosing not to attend the event.
• asking the photographer not to include them.
• the photographer asking you whether you are willing to be in a photo and asking you to step out of shot if you are not.
• where relevant, wearing the offered indicator that you do not want to appear in photos (e.g. a coloured sticker or different lanyard).
• where relevant, speak to the trip leader about whether it will be possible not to appear in photos / filming.

Where the lawful basis is consent, if you do not give consent, you have the right not to appear at all in the photograph or filming.

Where the lawful basis is 'for the performance of contract', you do not have the right not to appear in the photography or filming. For example, all staff and students must have their photograph taken and displayed on their University ID card, CCTV footage films anyone who is in the area filmed by the cameras and where student assessments involve photography or filming, the student must appear in the photography or filming else the assessment will count as a non-submission. For photography for identification purposes or student assessment, clothing covers a person’s face or head, a place will be provided where the covering will be removed by that person, in the presence of a designated person, for confirmation of identity. The photography / filming can then proceed with the person wearing the clothing which covers their face or head.

Photography / filming will be used for the University’s core business use which include supporting assessment, graduation, learning, marketing, professional development, research, student support and teaching. The resulting images (photographs / films) may be published in print, electronically and on the internet / intranet, including on the BCU’s social media accounts. It is possible for people to share posts from social media or save images from BCU social media accounts and re-use them. We keep the photography / filming for as long as it is necessary and useful for the core business purposes. When this time has been reached, the original photography / filming is securely destroyed.

Photography / filming for which the University is the data controller will be stored electronically on secure systems within the UK or EU. Access will be limited to relevant staff. However, the resulting images (photographs / films) may be published in print, electronically and on the internet / intranet.

If the lawful basis is legitimate interests, you have the right to request to ‘opt-out’ of being photographed as explained above. This phrase is used to indicate that a photograph has not yet been taken / filming has not yet happened.  The University will consider your request but is not obligated to grant it. You also have the right to object that you have appeared in photography or filming. If you wish to object after the photograph has been taken but during the event, you should speak to the photographer and ask them to delete the photograph. The photographer should use their professional judgement as to whether to do this. If the photographer believes there is a compelling reason not to, they should discuss this with a senior staff member at the event, or if that is not possible then ask the person to contact the Data Protection Officer (informationmanagement@bcu.ac.uk). Additionally, they could offer to take the person’s contact details (to only be used for this purpose and then deleted) so that the Data Protection Officer can contact them.

If someone objects after the photograph has been taken but before it has been used they should contact the Data Protection Officer (informationmanagement@bcu.ac.uk) who will liaise with the relevant staff to ensure that it all copies of the photograph are permanently deleted or consider whether it is possible to make edits to remove the person in question or render them unidentifiable in the images.

If the lawful basis is consent, you have the right to withdraw your consent. Consent is not applied retrospectively so where the photo has already been used and cannot be 'unused' e.g. the printing of a prospectus, the images will not be withdrawn or edited. However, the withdrawal of consent will mean that the image will not be used again in the future.

You may have the right to have your personal information deleted or the right to restrict processing. Follow the links to find out whether those rights apply in these circumstances. To do any of those things or if you have followed the links but would like clarification please email informationmanagement@bcu.ac.uk   

You have the right to see the personal data we hold about you. You can submit a Subject Access Request (SAR) in accordance with the Subject Access Requests (SAR) Procedure.

You have the right to lodge a complaint with the Information Commissioners Office about the handling of your personal data and can find out more about this on the ICO website.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices
• The Information Commissioner’s Office (ICO) information for members of the public