Photo management platforms are helping schools manage student images and publication permissions more efficiently. The appeal is obvious, but the technology can raise privacy questions that existing consent forms were never designed to address.
A growing number of schools are turning to photo management platforms to help manage student images and publication permissions. These tools can store photographs, record consent preferences and help staff identify students whose images cannot be used in school communications or marketing materials.
The benefits are clear. For schools managing thousands of photographs each year, photo management platforms can reduce administrative workload and help minimise the risk of an image being used where permission has not been granted. However, not every platform operates in the same way, so before introducing any new system, schools should understand exactly how it works and what information it collects.
A photo management platform is software designed to organise, search and manage large collections of photographs. In a school setting, these systems commonly allow staff to:
Schools are already familiar with privacy issues relating to student information, and photographs form part of that picture. To understand why biometric data may give rise to additional privacy considerations, it is helpful to understand how some photo management platforms identify individuals within images.
In those circumstances, the software analyses photographs and looks for unique facial characteristics, such as the distance between a person's eyes, the shape of their nose or other distinguishing features. The system then converts those characteristics into a digital record, commonly referred to as a ‘biometric template’.
A useful way to think about a biometric template is as a ‘digital face-print’. It’s not a photograph. Instead, it’s information derived from a photograph that allows a computer system to recognise the same person in other images.
Once a digital face-print has been created, the software can then compare it against other photographs stored in the platform. If it finds a match, it can automatically identify the student or suggest their name to staff. For example, a school might upload photographs from a sports carnival. Rather than requiring staff to manually tag every student, the platform would identify students whose digital face-prints already exist in the system and tag or flag as required.
This functionality can save time and improve the management of large image libraries. However, it also means the platform may be collecting and using more than photographs alone and that distinction is important because privacy law may treat biometric information differently from ordinary photographs.
Many schools already obtain parent consent for the taking, storage and publication of student photographs. When a school introduces a photo management platform, it may give rise to additional consent requirements.
For one thing, the platform may require its own, express consent. That means the general image/photography consent above would not likely extend to cover the school’s use of a platform that uses biometric technology. Most schools taking this seriously are choosing to create a separate, written, opt-in consent for the creation of a biometric template, obtained on its own terms rather than folded into an existing form. If a parent does not provide that consent, the school's existing manual process for managing photo permissions would continue to apply.
Photo management platforms can do more than help schools manage ‘do not publish’ requests. Many can also search, sort and organise a school's photo library by student, making it much easier for staff to find images.
That can be a valuable administrative tool, but it is not necessarily the same purpose that a parent had in mind when they agreed to the use of biometric technology to help manage photo permissions.
For that reason, schools should be careful not to assume that consent for one feature automatically extends to every feature the platform offers. If a school intends to use biometric technology both to manage photo permissions and to organise or search its photo library, it should make that clear from the outset.
Being upfront about how the platform will be used helps parents make informed decisions and reduces the risk of misunderstandings later on.
Before implementing a photo management platform, schools should take steps to understand how the technology operates and whether existing privacy practices remain appropriate. As part of that process, schools may wish to consider the following questions.
Schools should understand exactly how the platform identifies people in photographs. If the platform analyses facial features and creates biometric templates, schools should understand:
Where a third-party provider hosts or processes photographs and biometric information on the school's behalf, schools should ensure contractual arrangements appropriately address privacy obligations.
This may include matters such as:
Many schools already obtain consent to collect, store and publish student photographs. However, consent obtained for school photography may not Many schools already obtain consent to collect, store and publish student photographs. However, consent obtained for school photography may not necessarily address the creation and use of biometric templates. Schools should determine whether a separate opt-in consent process is required and, where necessary, update consent forms and collection notices accordingly.necessarily address the creation and use of biometric templates. Schools should determine whether a separate opt-in consent process is required and, where necessary, update consent forms and collection notices accordingly.
Parents, carers and staff are more likely to support new technology when its purpose and operation have been explained clearly. They should also be able to understand what the technology does without needing specialist technical knowledge. Communications should clearly explain:
Importantly, schools should be careful not to describe the platform in narrower terms than its intended use. For example, if the platform will be used to identify students through biometric matching, communications should say so expressly rather than describing it solely as a photo storage or library management tool.
Schools should establish clear processes for deciding when information is no longer required and what happens to it at that point.
This includes considering:
Privacy policies, collection notices, technology governance documents and relevant school policies should be reviewed to ensure they accurately reflect how the platform will operate in practice.
None of this means schools should avoid the technology. Photo management platforms have the potential to reduce administrative burden and improve the management of student images. For many schools, they may become a routine part of day-to-day operations.
Their adoption, however, should not be viewed solely as a technology decision.
Where biometric technology is involved, schools should take the opportunity to review privacy practices, consent processes and governance arrangements. Doing so can help ensure that the benefits of the technology are realised without creating unnecessary legal or reputational risk.
Useful resources include: