Good practice on the use of cameras and images

When can I take a photograph of someone?

There is no straightforward answer to this question; it depends on the expectation of privacy of the individuals involved and the purpose for which the image is taken.

Expectation of privacy

When a photograph can and cannot be taken legally depends to a great extent on the individual’s expectation of privacy when that image was taken. For example, someone walking down the street, or sitting in a room with a thousand people (for example at a graduation ceremony) would have a much lower expectation of privacy than when in the waiting room of a fertility clinic or unconscious on an operating table. You are unlikely to require consent to photograph people in the street or at a large public event, but it is essential that you obtain consent before photographing individuals in a clinical environment. Good practice requires that children’s images also be treated with particular care.

Purpose of the images

The purpose for which images have been taken is also relevant; photos taken purely for personal use (for example of friends at a party or by a parent of a child at a school nativity play for the family album) are not subject to the Data Protection Act. Photographs taken for business purposes, such as teaching, research, publication, publicity, advertising, administration, or the prevention or detection of crime, are subject to the Act and the University will be the data controller of such images.

It is also important to bear in mind that

  • photographs taken for one purpose (eg personal use) cannot be used for another (eg business use) without the consent of the individuals in the photographs
  • blocking out the eyes in a photograph does not anonymise it
  • images taken as part of medical treatment are legally part of the medical record
  • if personal data (including photographs) is obtained for University business using a personally owned device, that device must comply with the University's Mobile and Remote Working Policy (PDF, 95.1kb)
  • it is illegal to transfer personal data from one organisation to another without the consent of the data subject.

How should I get permission to take photographs?

In many cases, such as when taking photographs for publicity purposes, asking for and receiving permission to take the photograph will be enough to ensure compliance with the Data Protection Act. However, when taking and using photographs it is important to remember your legal duty to process data fairly and to protect individuals from unwarranted damage or distress. Therefore, the more likely it is that a reasonable person could be damaged or distressed by the use of their image, the more care you should take to obtain their informed consent to take and use the image. Bear in mind that others may not share your views on the publication of their image. Consent must always be obtained to use images for the purposes of teaching or research where an individual is clearly identifiable.