Privacy Notices Processing of personal data photography and publication permission in comprehensive schools and general upper secondary schools

When data is utilised for the school’s own use the data controller is the City of Espoo.

When data is used in the communications of the City of Espoo the data controller is the City of Espoo. If data, for example pictures, are published in the City’s social media channels the data controller is also the owner of the social media channel.

When data is used by the media the data controller is the media in question.

When data is utilised for the school’s own use the school’s principal is responsible for the register.

When data is used in the communications of the City of Espoo the people responsible for the register are

Finnish basic education, communications specialist Tytti Tyrväinen

Finnish general upper secondary education, communications specialist Maija Ruoho

Swedish education, communications specialist Karolina Lanu

When data is utilised for the school’s own use the school’s principal is the contact person of the register.

When data is used in the communications of the City of Espoo the contact persons for the register are

Finnish basic education, communications specialist Tytti Tyrväinen

Finnish general upper secondary education, communications specialist Maija Ruoho

Swedish education, communications specialist Karolina Lanu

firstname.lastname@espoo.fi

Data Protection Officer, City of Espoo

Address: POB 12, 02070 City of Espoo

Tel. +358 9 81621 (operator)

E-mail: tietosuoja@espoo.fi

The City of Espoo asks for the guardians’ and students’ permission with the Photography and publication permission on Wilma for the following purposes:

- School’s own use: Using recordings of the pupil/student, e.g. photographs, videos and voice recordings and the pupil’s/student’s work for the school’s own use. The school's own use includes displaying the recording or work in a closed electronic environment and in events organised by the school such as public functions and parents evenings.

- Use in the communications of the City of Espoo: Using the pupil's/student’s photographs and work in the City's and the school's websites or in social media channels, printed publications and electronic publications.

- Use by journalists/media: Filming/shooting and interviewing the pupil/student for example when writing for a newspaper or an online article.

- Use of a school photograph of the pupil/student in the Wilma/Primus student management system.

The City or school may also ask case-specifically permission for photography and publication in which case the purpose and ways of processing the data will be explained separately.

Giving the permission is voluntary and does not affect the pupil’s/student’s education.

School’s own use and use of a school photograph in the Wilma/Primus student management system

Grounds for processing personal data under the General Data Protection Regulation of the European Union: Article 6(1)(a) of the General Data Protection Regulation of the European Union: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

The guardian/student may revoke the consent at any time. Revoking the consent does not affect the legality of the processing that has been done before the consent was revoked. If the guardian/student wishes for example that the school removes a picture of the pupil/student which is on display in the school the guardian/student can contact the school.

Communications of the City of Espoo

With the guardian’s or student’s permission the pupil’s/student’s photographs and work may be used in the communications of the City of Espoo. The data is processed for journalistic purposes (Article 85 of the General Data Protection Regulation of the European Union and 27 § of the Data Protection Act). The guardian or the student can modify the permission on Wilma at any time and the updated permission/lack of permission will be taken into account the next time for example pictures are taken at the school for the communications of the City of Espoo.

If the guardian/student wishes for example that communications deletes a picture of the pupil/student which has been published the guardian/student can discuss the matter with the contact person of communications.

Media

With the guardian’s or student’s permission media can photograph and interview the pupil/student. Data Controller of this data is the media in question and the data is processed for journalistic purposes (Article 85 of the General Data Protection Regulation of the European Union and 27 § of the Data Protection Act).

Because the data is processed by the media the city cannot dictate for example how long the data is stored. The guardian/student may modify the permission on Wilma at any time and the updated permission will be taken into account the next time media would photograph or interview at the school.

Pictures, voice recordings and works. The media/journalist may ask the pupil’s/student’s name, age, and class. The permission form includes the pupil’s/student’s name and the guardian’s name.

PUBLICITY AND CONFIDENTIALITY OF DATA:

The data is not confidential according to legislation.

Sources of personal data: pupil/student or guardian.

The provision of personal data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract.

The City’s service providers can process the data on behalf of the City. If the data is saved on an electronic environment the service provider is the technical provider of the environment. If the data is published on the school’s or city’s website the data processor is the administrator of the website.

Communications of the City of Espoo stores the data in the City’s data bank (aineistopankki). The data is stored on the Granon server in Finland. There is a separate privacy notice about the data bank at https://www.espoo.fi/fi-FI/Asioi_verkossa/Tietosuoja/Tietosuojaselosteet (Tietosuojaseloste Espoon kaupungin aineistopankki).

If the data is published on a social media channel the data is disclosed to the social media channel in question. Social media channels handle service content, for example photographs and videos, in accordance with their own terms of use and data protection practices. The terms of service can be found on the websites of each service. For example:

- Facebook https://www.facebook.com/policy.php

- Instagram https://help.instagram.com/519522125107875

- Twitter https://twitter.com/en/privacy

- YouTube https://policies.google.com/privacy?hl=en

If a journalist/media photographs or interviews a pupil/student, the data is disclosed to the media in question.

The permission forms are on Wilma, on paper, or on the Granon server (data bank). Wilma is provided to the City by Visma.

Note that the Communications of the City of Espoo and media publish the data in sources available to the public.

The city as the data controller uses processors of personal data (service providers). The processors of personal data may transfer data outside the EU/EEA only if the transfer fulfils the requirements set in the legislation and if the transfer and the appropriate safeguards have been agreed in a contract between the data controller and the data processor.

Social media channels handle data in accordance with their own terms of use and data protection practices. For example Facebook, Instagram, Twitter, and YouTube mention that data is transferred outside the EU/EEA. The data transfer is regulated by the General Data Protection Regulation.

When media possesses the data the City cannot determine if the data is transferred outside the EU/EEA.

In the school’s own use the data can be used during the pupil’s/student’s compulsory education after which the data will be deleted unless there is a requirement based on a law to store the data.

Communications of the City of Espoo may use the photographs and videos for about three years in printed publications (for example guides and brochures) and electronic publications (for example espoo.fi website) and the City’s social media channels

Personal data that is included in the pictures stored in the City’s data bank will not be visible to all the data bank’s users when the picture is archived. The file and data are still visible to a small number of the city’s employees who have an admin right in the system.

When the media processes the data the City cannot determine the storage period.

When for example a filming/shoot is organised at the school the teacher will print the photography and publication permissions of the class in question. These permissions are stored at the school for five years.

When the filming/shoot is organised by the communications of the City of Espoo the teacher prints the photography and publication permissions on the day of the shoot, the photographer collects the permissions and archives them. The permissions are stored for five years.

IT equipment is located in protected and supervised premises. Access to the system is restricted based on user names and the user rights assigned to them. The archives and units have access control and locked doors. The documents are stored in controlled premises.

Further instructions on submitting information requests referred to in the General Data Protection Regulation: Data_protection/Client_rights

School’s own use: When the data is processed for the school’s own use the pupil/student or guardian has the right to obtain from the controller a copy of the personal data that is subject to processing. The controller shall provide the data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

Use in the communications of the City of Espoo or by the media: When data is processed for journalistic purposes the right to access data does not principally apply based on 27 § of the Data Protection Act. If the pupil/student or guardian has questions or comments about the City’s communications practices they can contact the contact person of communications.

If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Requests from the data subject and any resulting actions are free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

School’s own use: Pupil/student or guardian has the right to have inaccurate, incomplete, outdated or unnecessary personal data that we store either rectified or completed by us.

Use in the communications of the City of Espoo or by the media: When data is processed for journalistic purposes the right to rectification does not principally apply based on 27 § of the Data Protection Act. If the pupil/student or guardian has questions or comments about the City’s communications practices they can contact the contact person of communications.

School’s own use: Pupil/student or guardian has the right to have the controller erase their personal data without undue delay under certain conditions. The data subject does not have the right to erasure if the processing of data is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In these cases, the data will only be erased after the statutory time limit.

Use in the communications of the City of Espoo or by the media: When data is processed for journalistic purposes principally the right to erasure of the data does not principally apply based on 27 § of the Data Protection Act. If the pupil/student or guardian has questions or comments about the City’s communications practices they can contact the contact person of communications.

School’s own use: The pupil/student or guardian has the right to have the processing of data restricted if one of the requirements listed in Article 18 (a-d) of the General Data Protection Regulation is fulfilled.

Use in the communications of the City of Espoo or by the media: When data is processed for journalistic purposes principally the right to restriction of processing does not principally apply based on 27 § of the Data Protection Act. If the pupil/student or guardian has questions or comments about the City’s communications practices they can contact the contact person of communications.

You have the right to lodge a complaint with a supervisory authority if you feel that the processing of your personal data is in infringement of data protection legislation. You can lodge a complaint with the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/home(external link, opens in a new window)