This guidance covers photos or video (images) of people taken for University purposes.
If the image can be used to identify an individual and tell you something about them it is likely that it will be personal data for the purpose of the General Data Protection Regulation (GDPR). People can obviously be identified from names but may also be identified from contextual information e.g. the caption reads: ‘This photo shows students working in the Law library’.
Where an image is clearly of an individual or group of individuals, who are the focus of the image, it will be personal data, and consent is required to use it. Although the GDPR does not specify that consent should be in written form it is strongly recommended that you obtain written consent so that you have a record, in case of subsequent disputes.
I give permission to the University of Oxford for my photograph and written profile to be used in the [Undergraduate Prospectus and University website] and other promotional material for which it may be suitable. Images will be held and used in publicity for up to X years.
Although the GDPR does not specify an age limit where images of children are being taken it is important to obtain written consent from the child’s parent/guardian.