Background
An organisation posted photographs of young children on its social media account. The parents of one of the children featured had been asked to consent to this use of their child’s image, but had specifically
not provided this consent.
The parent in question happened to see two photographs of their child on the social media feed of a senior member of the organisation’s staff from previous years. The parent messaged the member of staff immediately and was told the
images would be removed. But the staff member did not remove them.
The parent then found many more photographs of their child posted on the organisation’s social media feed in the previous 18 months. The parent messaged the member of staff again which led to only one of the photographs being taken down. Compounding the parent’s concerns, at least two photographs were originally shared by a member of staff – and then re-shared by the organisation. The parent formally complained. It took several days and the involvement of multiple senior members of the organisation’s staff to ensure all the photographs were removed.
Learning points
- This shows the importance of ensuring that a ‘lawful processing condition’ applies before processing commences, the processing in this case being the posting of photographs on a social media site.
- The organisation was relying on the lawful processing condition of ‘consent’ and they should have checked all consent forms to ensure that parents had actually provided consent – and should have not included images of children whose parents had not agreed to the images being shared publicly.
- There are many legitimate reasons why parents do not give consent for photographs of their children to be shared, often for security concerns. Regardless of the reasons behind a parent not wanting photos of their child being shared, if you have asked for permission (consent) to do so and consent has either not been provided or you’ve specifically been told no then, for ethical as well as legal reasons, that choice must be respected. When a breach of such importance is raised, it is imperative that action is taken immediately. Strict staff procedures must be in place and staff fully trained. This should include reminding staff of the serious consequences of personal data falling into the wrong hands, especially that of young children.