Compliance with Data Protection

[John Upham]

I note a new item that has appeared on the ECF web site viz :

http://www.englishchess.org.uk/organisa ... _feb09.htm

What is the impact of this edict?

[Mike Truran]

I would venture to surmise that most of the bureaucratic s**t that ties us up in knots in the UK is caused not by the law givers (who generally have little idea, and probably care less, about the effect of their laws) but by the law receivers (who, frightened of shadows and unable to obtain any clear and sensible guidance on those laws from our so-called public servants, gold plate things of their own accord to avoid any possible risk to themselves). Of course, by then the law givers have moved on to their next pet project......

And that's probably one of the reasons why so many volunteers eventually lose the will to live.

[Paul Buswell]

For what it's worth, I have seen announcements at an ECF Congress asking if I object to my photo being taken, and I said that I did. And occasionally press photographers at other events ask, and get the same reply.

Not for any reason connected to the ECF's concerns, but solely because that is my wish. I don't think my wish is at all enforceable in such quasi-public circumstances, but as I am being asked that is the reply I give.

PB

[Matt Harrison]

Of course, publishing photos of people at tournaments is almost completely outside the scope of Data Protection law. The data isn't stored in a 'relevant filing system' . If there was for example a feature that enabled you to input a name and retrieve photos of that person, then it would be covered by the DPA.

There may of course be other rights of privacy under Article 8 of the Human Rights Act, but that only applies to public bodies.

So we come down in the end to common courtesy. It seems to me that rewording this edict in this light would be more appropriate.

It's the knee-jerk resort to the DPA that annoys me, when few people who do this appear to have even read the relevant legislation.

The Office of Public Sector Information (www.opsi.gov.uk) has the full text of the relevant laws.

From the Office of the Information Commissioner:

Myth – “The Data Protection Act stops parents from taking photos in schools”.
Reality - Photographs taken purely for personal use are exempt from the Data Protection Act. This means that parents, friends and family members can take photographs for the family album of their children and friends participating in school activities and can film events at school. The Data Protection Act does apply where photographs are taken for official use by schools and colleges, such as for identity passes, and these images are stored with personal details such as names. Where the Act does apply, it will usually be enough for the photographer to ask for permission to ensure compliance with the Act. The Information Commissioner’s Office has issued practical guidance on this subject.
1

[Sean Hewitt]

Of course, publishing photos of people at tournaments is almost completely outside the scope of Data Protection law.

Sadly Matt, that's not the case.

If the photos are for purely private use you are right, the DPA does not apply. But if an organiser (ie me) takes publicity photos for use on a website etc, or publication in a newsletter, then the DPA does indeed apply. At least, thats what the information commissioner told me.

[Mike Truran]

The full guidance note from the ICO is below. The final example (media use) seems to be the most relevant one and indicates that the DPA does indeed apply. NB the stress on the application of common sense!

Data Protection Good Practice Note
Taking Photographs in Schools
This Good Practice Guidance is aimed at Local Education Authorities and those
working within schools, colleges and universities. It gives advice on taking
photographs in educational institutions and whether doing so must comply with the
Data Protection Act 1998.
Recommended Good Practice
The Data Protection Act is unlikely to apply in many cases where photographs are
taken in schools and other educational institutions. Fear of breaching the provisions
of the Act should not be wrongly used to stop people taking photographs or videos
which provide many with much pleasure.
Where the Act does apply, a common sense approach suggests that if the
photographer asks for permission to take a photograph, this will usually be enough to
ensure compliance.
• Photos taken for official school use may be covered by the Act and pupils and
students should be advised why they are being taken.
• Photos taken purely for personal use are exempt from the Act.
Examples
Personal use:
• A parent takes a photograph of their child and some friends taking part in the
school Sports Day to be put in the family photo album. These images are for
personal use and the Data Protection Act does not apply.
• Grandparents are invited to the school nativity play and wish to video it. These
images are for personal use and the Data Protection Act does not apply.
Official school use:
• Photographs of pupils or students are taken for building passes. These images
are likely to be stored electronically with other personal data and the terms of
the Act will apply.
• A small group of pupils are photographed during a science lesson and the
photo is to be used in the school prospectus. This is unlikely to be personal
data and the Act wouldn’t apply.
Media use:
• A photograph is taken by a local newspaper of a school awards ceremony. As
long as the school has agreed to this, and the children and/or their guardians
are aware that photographs of those attending the ceremony may appear in the
newspaper, this will not breach the Act
Further Information
If you require any further information about this or any other aspect of Data Protection,
please contact us using the details below:
Web: www.ico.gov.uk
Email: [email protected]
Telephone: 01625 545700

[Gary Cook]

Sean, I'm curious to know exactly what data would need protecting if a photo was taken and published of a chess tournament.
Gary

[Mike Truran]

Gary, we may not like the ICO guidelines but they do seem to be reasonably clear on the need to make parents/guardians and/or children etc aware that their photos might be published. Given that, it doesn't really matter what Sean, I or anybody else thinks.

We reap what we sow. If there's enough perceived public concern (some might call it paranoia) about any issue any government, conscious of votes, is going to leap into action and pander to the public mood with as much legislation as it thinks it can get away with.

[Matt Harrison]

It is at the very most arguable whether the DPA applies. There are two main criteria in the DPA - is it personal data (ie. can someone be identified from it?) Photos are clearly potentially covered. And secondly is it stored in a relevant filing system. With newspapers and the internet, the potential for search engine retrieval makes it possible that these can be covered. But it is a very arguable point.

Note where the guidance says that publication of photos in a school brochure is outside the scope. This is different from the newspaper example where the photo might be expected to be captioned with names, or have them mentioned in an article, making retrieval more possible.

[Mike Truran]

I'm no particular defender of the ECF's stance, but why is publication in a newspaper (the example specifically given in the guidelines where notification to parents etc is required) particularly diffferent from publication in Chess Moves, the Right Move, the ECF website etc?

[JustinHorton]

It is possible that, as Paul notes, people may object to having their photos taken (I have done in certain situations) and given that they may, there's no particular reason why they shouldn't be invited to make their objections beforehand so as to avoid problems later.

I don't find this advice particularly onerous and I'm not at all sure what the fuss is about. There are genuine issues involving the the retention and dissemination of personal data, including images, which are not at all straightforward to define exactly or to resolve. Now of course disclaimers can be a way of covering one's arse without actually helping. I have, for example, a friend who has a nut allergy who absolutely hates it when a restuarant menu says "some of our items may contain nuts" which in effect says "we can't be bothered to tell you which ones, or to make sure not to contaminate any of our other dishes, so naff off and eat elsewhere". But this particular piece of advice doesn't - unless I am missing something - serve to confuse the issue or disempower anybody, nor cause anybody an intolerable amount of work.

[Mike Truran]

Where I do take issue with the ECF is in their usual goldplating of the requirements (which we also saw with their approach to ECF membership) based presumably either on fear, ignorance, bad advice or indeed all three. Per the most relevant example in the ICO guidelines (the newspaper one), item 1., the final two stipulations in item 2. and item 3. of the ECF communique would not seem to be required. I have emailed the ECF to ask why they are goldplating in this way, but I'm not holding my breath waiting for a sensible reply.

[JustinHorton]

I can see reason in all of these: for instance, you are supposed to make known the officer whose responsibilities include DPA compliance. It's possible that they stem from the fact that there's a separation between the location of the event and the ECF itself: someone attending may not appreciate that the ECF has any responsibility in the matter (or even that it has anything to do with the event) and conversely the ECF may need to show that the information they received was properly acquired.

If you provided, say, your personal details to Ambridge Public Library in applying to join, they might not have an officer directly responsible for DPA compliance on the premises: it would more likely be the responsibility of an officer at Borsetshire County Council. Hence Ambridge's form would carry the name and probably the contact details of that officer. Borsetshire, though, probably wouldn't need to have a separate confirmation from Ambridge that procedures had been followed - but only because those procedures would be in place, and subject to check at any time through the reporting structure. The ECF don't directly control the chess event in that way (nor should, nor wish to) but they may need something specific in lieu.

I'm not necessarily (or even probably) right, though, and of course your questions aren't unreasonable and should receive a proper response. But as it stands I personally wouldn't quarrel with what's been asked.

[Roger de Coverly]

This seems to be a follow-up to an item from the January board meeting.

Quoting from David Sedgwick's report at http://www.sccu.ndo.co.uk/bcf.htm

(8) Information Commission Complaint. A parent had complained about the publication on the ECF website of a photograph of children submitted by the organiser of an event (not an ECF event). This had appeared alongside the list of prize winners. It would appear that the necessary permission had not in this instance been obtained.
The material in question had been removed, but unfortunately it had been overlooked that the photograph in question had also appeared in ChessMoves and this initially remained available online on the site. Upon discovering this, the parent had complained to the Information Commission. The relevant material had now been removed from the online archive and Congress Organisers would be sent a circular stressing the need to be rigorous in obtaining permission for the publication of photographs of children. Provided that ECF procedures were tightened in this way the Information Commission would be unlikely to take further action.

I've highlighted the "of children" bit, which seems to have gone missing from the guidelines.

Simplest solution is not to send the ECF any pictures.

[Mike Truran]

That's right - the 4NCL will probably adopt exactly that position.

Anyway, the board minute is misleading and disingenuous. Per the ICO guidelines you only need active permission from the event organisers - you just need to make the relevant people (parents etc) aware that photos may be taken for publication so that they have the opportunity to object, but explicit permission is not required.

That's my point about the ECF goldplating the requirement.