There is no straightforward answer to this question; it depends on the expectation of privacy of the individuals involved and the purpose for which the image is taken.
When a photograph can and cannot be taken legally depends to a great extent on the individual’s expectation of privacy when that image was taken. For example, someone walking down the street, or sitting in a room with a thousand people (for example at a graduation ceremony) would have a much lower expectation of privacy than when in the waiting room of a fertility clinic or unconscious on an operating table. You are unlikely to require consent to photograph people in the street or at a large public event, but it is essential that you obtain consent before photographing individuals in a clinical environment. Good practice requires that children’s images also be treated with particular care.
The purpose for which images have been taken is also relevant; photos taken purely for personal use (for example of friends at a party or by a parent of a child at a school nativity play for the family album) are not subject to the Data Protection Act. Photographs taken for business purposes, such as teaching, research, publication, publicity, advertising, administration, or the prevention or detection of crime, are subject to the Act and the University will be the data controller of such images.
It is also important to bear in mind that
In many cases, such as when taking photographs for publicity purposes, asking for and receiving permission to take the photograph will be enough to ensure compliance with the Data Protection Act. However, when taking and using photographs it is important to remember your legal duty to process data fairly and to protect individuals from unwarranted damage or distress. Therefore, the more likely it is that a reasonable person could be caused damage or distress by the use of their image, the more care you should take to obtain their informed consent to take and use the image. Bear in mind that others may not share your views on the publication of their image. Consent must always be obtained to use images for the purposes of teaching or research where an individual is clearly identifiable.