This was a recent query via my data protection support network: is it alright under GDPR for staff to buy school class group photos and have them at home? This was my response.
From the member of staff’s perspective the purchasing and holding of the class photo is not covered by GDPR because it is for their own personal (domestic) use.
From the school’s perspective, GDPR is applicable and we need to think about what is reasonable.
Could the pupils be identified if someone didn’t know them? I’m assuming there will no names attached to the images in the photo so someone who did not know the children could not identify them from it.
I am also assuming that originally you might have had consent from the parent for their child to be in a class photo? So, by default, they would know that their child’s image would be available to others apart from themselves, as it is a class photo. On this basis, it would seem reasonable that the class photo is available to members of staff as well, especially as they know the children.
In conclusion, I think it is fine under GDPR for staff members to buy school class group photos. and have them at home.
Practical advice and guidance on school data protection queries is all part of my DPO Service. If you would like to know more about how I can support you to be confident that you are meeting data protection requirements, please get in contact.