Privacy notice: Processing of personal data, consent for photography, filming and publication in the Growth and Learning Sector

Date of publication: 11 March 2025

When the data is used for the internal purposes of a unit, the data controller is the City of Espoo. When the data is used for the City of Espoo’s communication purposes, the data controller is the City of Espoo. If photographs are published on the city’s social media channels, the organisation that owns the social media channel also acts as a data controller.

In the case of the media, the data controller is the media outlet in question.

When the data is used for the internal purposes of a unit, the responsible person is the unit’s director.

The City of Espoo’s Growth and Learning Sector’s management is responsible for the sector’s information systems and communications related to education.

When the data is used for the internal purposes of a unit, the contact person is the principal / school director / director of the early childhood education unit / manager of local youth services.

For the City of Espoo’s communications, the contact persons are:

Finnish Early Childhood Education, Communications Specialist Mia-Marisa Ranta

Finnish Basic Education, Communications Specialist Netta Huuskonen

Finnish Upper Secondary Education, Communications Specialist Kirsi Suni

Svenska bildningstjänster, Communications Specialist Lena Hinkkanen

Youth Services, Communications Specialist Emil Jokipelto

firstname.lastname@espoo.fi

Primus administration: primusyllapito@espoo.fi

eVaka administration: evaka@espoo.fi

Data Protection Officer of the City of Espoo

Helena Niemi

Address: P.O. Box 12, 02070 City of Espoo

Tel. 09 816 21 (switchboard)

Email address: tietosuoja@espoo.fi

With the photography and filming consent form, students and guardians of children and young people are asked for permission for the following:

1. Units, such as day care centres, schools, educational institutions or youth centres:
   1. To use photographs or video recordings of the child / young person, as well as their creations, for the internal purposes of the unit – for example, displaying them in the unit’s closed digital environment or presenting them at events and in spaces organised by the unit. Photographs and video recordings, as well as the child’s/young person’s creations, may also be used as part of pupil assessment.
   2. To use photographs or video recordings of the child/young person, as well as their creations, on the unit’s own social media channels.
2. City of Espoo’s communications:
   1. To use photographs or video recordings of the child/young person, as well as their creations, in the City of Espoo’s communications, including the city’s website (espoo.fi), social media channels, printed materials and digital publications. Children’s / young people’s creations may refer to, for example, photographs of drawings, crafts or other projects made by the child/pupil/student.
   2. Media: To photograph or interview the child/young person.
   3. For communications related to the City of Espoo carried out with partners, such as recruitment campaigns.

In addition, guardians or young people may be asked for case-specific consent for photography, filming or publication, in which case the purpose and methods of processing will be clearly explained when the consent is requested. Providing consent is voluntary and refusing consent will not affect the service or education provided.

The legal basis for processing is the consent provided by the guardian/student (Article 6(1)(a) of the General Data Protection Regulation of the European Union).

The guardian/student has the right to withdraw their consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Media

Media outlets may photograph and interview the child/pupil/student with the consent of the guardian/student. The media outlet in question is the data controller for the material, and the grounds for processing are journalistic purposes (Article 85 of the General Data Protection Regulation of the European Union and section 27 of the Data Protection Act). As the material is owned by the media outlet, the city cannot, for example, determine how long the data will be stored.

Consent for photography and filming

The photography and filming consent form includes the name of the child/young person and the name of their guardian.

The guardian or student can modify the consent they have given at any time, and the updated consent will be taken into account the next time when, for example, photos are taken within the unit.

The following data is processed in early childhood education consent forms:

A general media consent, which is requested only once, and a media consent for special situations, which is requested separately each time. A separate photography, filming and interview consent is also in use; this consent is requested separately each time.

The child’s name and the name of the early childhood education unit

Consent is requested for the following:

1. Publications, photographs and video recordings created by the child on different platforms
2. Media content on the child on different platforms
3. Consent for the use of the early childhood education group’s Teams

For other potential uses, consent is requested separately on a case-by-case basis.

Content of the school consent form:

Consent is requested for the following:

1. Pupil’s photographs and creations on school premises and at school events
2. Pupil’s photographs and creations on the school’s and city’s websites or social media channels
3. Photographing, filming or interviewing the pupil for media purposes
4. Use of the pupil’s school photo in the Wilma/Primus system

Content of the youth services consent form:

Consent is requested for the following:

1. Young person’s photographs and creations on youth centre premises and at youth centre events
2. Young person’s photographs and creations on the youth centre’s and city’s websites or social media channels
3. Photographing, filming or interviewing the young person for media purposes

Consent for publication is obtained from the guardian or the young person. A young person may give consent once they reach the age of 15.

Data may be processed on behalf of the City of Espoo by its service providers. If data is stored in an electronic environment, the service provider is the technical service provider of the environment. If data is published on the unit’s or the city’s website, the data processor is the site administrator.

The City of Espoo’s communications staff stores the material in the city’s media bank, which is stored on Grano’s servers in Finland.

The media bank has a separate privacy notice available in Finnish: Henkilötietojen käsittely, aineistopankki.

If the data is published on social media platforms, the data is disclosed to the social media platforms in question. Social media platforms process the content, such as photographs and videos, according to their own terms. The terms and conditions can be found on the websites of each platform. Here are some of them:

- Facebook https://en-gb.facebook.com/privacy/explanation(external link, opens in a new window)

- Instagram https://help.instagram.com/519522125107875(external link, opens in a new window)

- Threads https://help.instagram.com/515230437301944(external link, opens in a new window)

- YouTube https://policies.google.com/privacy?hl=en(external link, opens in a new window)

If a media outlet photographs, films or interviews a child/young person, the data is disclosed to the media outlet in question, which is responsible for storing the data.

The city’s photography and filming consent forms are stored in Wilma, eVaka, SharePoint, or in paper format in a locked space within the relevant unit, as part of the child’s/young person’s other paper documents.

Please note that the city’s communications staff and media outlets may publish materials in publicly accessible sources.

Use of photographs and video recordings in units

Digitised material is shared with guardians through the pedagogical documentation section on eVaka. Photographs and media content can also be shared with guardians through the cloud service linked to the staff’s Microsoft 365 account. Guardians will receive a link to the content by email. Pre-primary education units also use a Google Workspace account, and its cloud service can be used for sharing material to guardians and children. Any content where one can also identify other children may only be shared with the consent of these children’s guardians.

In educational institutions, visual materials are processed, for example, within the school’s closed digital environments. Internal use also includes events organised by the educational institution, such as parents’ evenings and public events, where children’s creations and related recordings (e.g., visual arts or written work) may be displayed.

As the data controller, the city uses personal data processors (service providers). Processors may transfer data from the register outside the European Union or the European Economic Area only if the transfer meets the applicable statutory requirements and if the transfer and appropriate protection measures have been agreed upon between the controller and the processor as required by data protection legislation.

Social media platforms, as data controllers, process the data according to their own terms.

For instance, Facebook, Instagram and YouTube mention the transfer of data outside the EU/EEA. Such transfers are regulated by the General Data Protection Regulation of the European Union. When the data is held by the media, the city does not have a say in how the data is transferred.

Data is stored and destroyed in line with the City of Espoo’s records management plan and the applicable provisions and regulations issued by the National Archives of Finland.

Photos and videos stored in the city’s media bank are used for approximately five years. After this period, the material is archived in the media bank and no longer republished. (Read more in the media bank’s privacy notice.)

When data is processed by a media outlet, the City of Espoo does not have a say in how the data is stored.

Data protection legislation guarantees various rights for the data subject in relation to the processing of personal data. Requests concerning the data subject’s rights can be submitted to the city’s Data Protection Officer or the contact person of the register using the above-mentioned contact details.

If necessary, the controller may ask the data subject to provide additional information to fulfil the request.

The controller must respond to a request concerning the data subject’s rights without undue delay and no later than one month after receiving the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

If the data controller does not take action on the request of the data subject, the data controller must inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are, as a rule, free of charge. However, where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her is being processed as well as the right to access the data and to obtain a copy of the data. However, the provision of data shall not adversely affect the rights or freedoms of others.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Under certain conditions, the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her. For example, if the processing of personal data is based on consent and the data subject withdraws his or her consent and there is no other legal ground for the processing, the data subject shall have the right to have his or her data erased. However, the data subject shall not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The data subject shall have the right to request the restriction of processing in certain situations. For example, if the accuracy of the personal data is contested by the data subject, processing is restricted for a period enabling the controller to verify the accuracy of the personal data. The right also applies if the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, which is processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In such a situation, the controller may only continue processing the personal data if the controller demonstrates compelling legitimate grounds for the processing. Processing may also continue if it is necessary for the establishment, exercise or defence of legal claims.

The data subject shall have the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes data protection legislation. The data subject can lodge a complaint with the Office of the Data Protection Ombudsman: www.tietosuoja.fi(external link, opens in a new window).

Change history: -