Photography and Filming Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

This privacy notice does not apply to photography or video footage created by members of the Edinburgh College community or visitors for their private use on personal equipment. Edinburgh College is not responsible for the data held on these recordings, nor is it the data controller.

Why are we collecting it, and what are we doing with it (Purpose)?

Photography and video footage are essential for the College to promote our services and may be used for:
College publicity material, e.g. prospectuses, posters, flyers, and other marketing materials, to be circulated on a worldwide scale
Local, national or international press in advertising/features relating to the college.
The college website promotes the College and its courses and services.
College publicity videos and/or national or international television adverts and features.
The college’s social media channels promote the College and its courses and services
Promotional work by external organisations with which the college is working in partnership to promote the college sector, e.g., Colleges Scotland.

Photographs and/or filmed images or footage taken as part of a student’s course may also be posted on their course’s Team page.

What personal data do we collect?

Photography, video footage and audio recordings featuring identifiable individuals
Name
Email
Published photos and video footage may include details such as your name and course, as well as additional context for the images.

How are we collecting this information? What is the source?

Photographs, video footage and audio recordings will be taken/recorded by Edinburgh College staff, our third-party contractor and occasionally by partner organisations.

All staff, students, and stakeholders involved in photography or video activities related to Edinburgh College will be required to complete an ‘image release form’ to give consent.

The lawful basis for the processing

The legal basis for processing under UK GDPR Article 6(1)(a) is ‘the data subject has given consent to the processing of his or her personal data for one or more specific purposes’.

Since photographs may reveal details of a subject's race and ethnic origin, they are considered Special Category Data. The legal basis for processing this personal data under UK GDPR Article 9(2)(a) is ‘the data subject has given explicit consent’.

Who we share the information with

The photos/videos will be made publicly available (see purpose), and the College will need to share them with other organisations as appropriate, e.g., newspapers. The photos/videos will also be shared with external organisations with which the college is working in partnership for use in their promotional work on the college sector, e.g. Colleges Scotland.

How long do we hold the personal data?

Completed image release forms, photographs, and videos will be held securely on the College's internal systems and destroyed 5 years after the event.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

Right to be Informed – i.e. a privacy notice.
Right of Access – this means you have the right to access your personal information.
Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
Right to Object – this means you can object to how your data is used.
Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF