The Department for Education has recently issued a warning to schools following a number of incidents where students’ photographs were scraped from school websites by third parties and subsequently used for illegal purposes.

The incidents have understandably raised concerns across the education sector, prompting an important question: What liability, if any, does a school face when photographs published on its website are misused by a third party?

The starting position is that a school is not automatically liable simply because a third party has scraped photographs from its website and subsequently used them for illegal purposes. In most cases, liability will depend on whether the school acted lawfully, reasonably and in accordance with its safeguarding and data protection obligations when the photographs were originally published.

When considering a school’s potential legal exposure, several questions are likely to be relevant:

• Did the school have a lawful basis for publishing the photographs?
• Were appropriate consents obtained?
• Were there any known safeguarding concerns or risks?
• Was the misuse of the photographs reasonably foreseeable?
• What safeguards and policies were in place to protect students and their personal data?
• Did the school’s actions or omissions contribute to the harm suffered?

Where concerns are identified, schools may face a range of consequences, including:

• Regulatory action – the ICO may investigate complaints and take enforcement action where publication breaches data protection regulations.
• Compensation claims – data subjects may seek compensation where unlawful processing causes material damage or distress.
• Negligence claims – a claimant might argue that the school failed to take reasonable safeguarding steps, particularly where risks were known and foreseeable.
• Reputational damage – regardless of liability, incidents involving student photographs can significantly impact trust and confidence among pupils, parents and the wider school community.

These incidents serve as an important reminder for schools to review their policies and procedures relating to the publication of student photographs, ensuring that safeguarding, data protection and risk assessment considerations remain at the forefront of decision-making.

We recognise that schools have a legitimate interest in showcasing school life, celebrating student achievements and creating a positive first impression through their websites and other communications. The solution is therefore not to avoid publishing photographs altogether, but to ensure that the associated risks are appropriately identified, assessed and managed.

To help mitigate risk and manage potential liability, schools should implement a clear written policy covering photography, filming and the use of photographs across websites, social media platforms, and marketing materials. The policy should be circulated to parents, carers and staff at the start of each academic year, providing an opportunity for consent preferences, objections and safeguarding concerns to be identified, recorded and reviewed.

Schools should also consider adopting an internal approval checklist before publishing any photographs. This can help ensure that appropriate consents have been obtained, safeguarding risks have been assessed, and publication is consistent with the school’s data protection and safeguarding obligations.

If you have concerns about the use of student photographs, data protection compliance, or safeguarding-related risks, or would like to review your existing policies and procedures ahead of the new academic year, we’re here to help. Get in touch with Karen Crutchley on KarenCrutchley@schofieldsweeney.co.uk or Tina Morris on TinaMorris@schofieldsweeney.co.uk.