Durham University

Information Governance

Filming and Photography

This guidance relates to images of people, including photos and videos, for the University’s own purposes. It applies to images that are planned to be taken in the future as well as those currently stored by the University.

If you are engaging a third party to take some pictures for publicity or marketing, then you need to take extra consideration of the purpose and the information that will be recorded.

Do: Consider whether there is an alternative to using people in images. If not,

Do: Consider the purpose of capturing the images, and any supporting data that you are recording regarding the content of the images. In general, if an image can be used to identify a living individual, it is likely to be personal data and that by taking and using these images you will be processing that personal data.

Do: Identify whether images you plan to capture are personal data.

Examples of images not likely to be personal data

Examples of images likely to be personal data

A picture of a face

A picture of a face with information that identifies the individual, e.g. name badge, caption specifying a year and degree subject, annotated names or metadata (a set of data that describes and gives information about other data) in the file

A video of someone in the street

Use of the video when investigating an incident, whether the subject of the video is involved or not, would make the image personal data if they could be identified

Images of a crowd or a group of individuals

Body Worn Video. This is typically used for safety and security reasons and to provide evidence of activities, so the images processed are likely to be personal data. Please refer to the specific guidance for assistance in the selection and use of Body Worn Video

Images taken for personal use only e.g. photos taken by family members at a graduation ceremony. You should be able to do so unless there are other local conditions that prevent it such as a ban on photography and filming

What should I do if images are not personal data?

Do: Respect the preferences of individuals who request not to be recorded

Do: Inform those present that images are being taken

Do: Consider making announcements or putting up signs to inform event attendees that images will be captured by the University

Do: Consider issuing coloured badges or lanyards that can be used to identify those individuals who did not want to be included in any images

What should I do if images are personal data?

Before any images are taken:

Do: Use the University’s guidance to ensure that the appropriate lawful basis is identified to enable you to process the personal data. For the University’s purposes, the two most appropriate bases would be either legitimate interests or consent.

Do: Remember that if consent is the lawful basis, this consent can be withdrawn at any time and the participants will need to be informed of this right.

Do not: Continue to use existing images of individuals, or take further images of them, where consent was the lawful basis and this has been withdrawn. To do so would be in breach of data protection legislation.

Do: Refer to the University’s guidance to ensure that privacy information is given to those being photographed / filmed.

Do: Undertake a legitimate interests assessment if you plan to use this as your lawful basis.

Do: Remember that individuals can ask the University to stop processing their personal data. You will need to comply with this, unless you can show that the University’s legitimate interests are compelling enough to justify the continued processing of those images. Your legitimate interests assessment therefore needs to be robust enough to support the continued processing.

Do: Contact the Information Governance Unit for advice if needed upon receipt of such requests.

Do not: Use images for another purpose other than the one recorded in either your legitimate interests assessment or that for which consent was gained.