Recording lessons for self-isolating pupils – data protection compliance

From the start of the 2020/21 academic year, pupils across all year groups were expected to return to school full-time. Despite this, COVID-19 continues to have a notable impact on school attendance.

Schools are now under an obligation to provide remote education to pupils of compulsory school age who are unable to attend school because of Covid-19 – i.e. they are required not to attend due Government guidance or law. As such, many schools are recording live lessons as a way to ensure that self-isolating pupils are provided with learning experiences as similar as possible to their classmates, whilst also avoiding the need for teachers to deliver the same lessons multiple times.

In this briefing, we cover some key questions that schools looking to record lessons for self-isolating pupils need to consider so that they are compliant with their obligations under data protection law

Why is data protection relevant?

Creating video recordings of live lessons involves the processing of personal data of individuals featured (either by being visible or where their voices are captured). Schools, as data controllers, have a responsibility to ensure that any processing of personal data in this way is compliant with data protection law. As part of this, schools need to comply with the data protection principles set out in the General Data Protection Regulation (GDPR) when creating and sharing recordings of lessons.

How do schools make sure they are processing personal data lawfully?

The first data protection principle provides that any processing of personal data must be lawful, fair and transparent. As such, the school must be able to identify an appropriate lawful basis for processing personal data captured in video recordings of lessons, in accordance with Article 6 GDPR.

The most appropriate lawful basis will depend on the type of school processing the personal data. Generally speaking, the most appropriate lawful basis for academy trusts and maintained schools is likely to be that the processing is necessary for a performance of a task carried out in the public interest (the “public task” lawful basis). For independent schools, the most appropriate legal basis is likely to be that the processing is necessary for the purposes of the legitimate interests pursued by the school or by a third party (the “legitimate interests” lawful basis).

The lawful basis of “consent” is unlikely to be an appropriate lawful basis for recording live lessons. This is because it can be difficult to ensure that consent meets the GDPR standard of being freely given due to the imbalance of power between the school and pupils/parents and staff. Further, consent must be capable of being withdrawn, which may pose issues after recordings have been made available to self-isolating students. Ultimately however, determining the legal basis will be a matter for each school to determine based on its own unique circumstances.

It is important to note that recording lessons must be a targeted and proportionate way of achieving the specific purpose of delivering remote education so that it is fair to the individuals involved. Schools may therefore run into difficulty if they could reasonably achieve the purpose by some other less intrusive means, or by limiting the processing of personal data to what is necessary (e.g. through use of audio only).

Pupils and staff appearing in recording should also be aware of their personal data being used in this way and so this is a good opportunity to review the school’s privacy notices to ensure that the school’s lesson recording practices are fully transparent.

How long should schools retain lesson recordings?

Under the GDPR schools must only retain personal data for as long as is necessary depending on the purposes for which it is being processed, after which time the personal data should be erased or anonymised. This reduces the risk that the personal data becomes irrelevant, excessive, inaccurate or out of date, or that the retention of the data becomes unlawful.

Lesson recordings will be a relatively new concept for many schools and so existing records retention policies may not provide guidance. Schools should therefore review the purposes for which they will be retaining lesson recordings (e.g. safeguarding monitoring, to facilitate remote learning for pupils that are self-isolating etc.) and be clear as to when those purposes have been served). Schools also need to consider other relevant obligations, such as the prohibition on destroying records relevant to the Independent Inquiry into Child Sexual Abuse (“IICSA”), e.g. where a video recording of a lesson raises a safeguarding concern.

What other steps should schools take to comply with data protection law?

Schools should also consider other data protection principles as follows:

• Purpose limitation: Schools should ensure they clearly define the purpose/s for which the recordings may be used and communicate this to teaching staff (and pupils) in a transparent manner. These recordings should not be used for any additional purposes.
• Data minimisation: It is important to make sure that recordings do not contain any unnecessary personal data, and that personal data captured is adequate, relevant and limited. Where possible, recordings should also be reviewed by teachers before they go live, so that any content that should not be included can be deleted.
• Data security: Appropriate security measures should be implemented to protect personal data contained within recordings. Schools should consider the measures necessary to ensure personal data is secure within internal systems and when being shared externally, for example, use of password protection, and platforms designed to restrict access and sharing externally/downloading. It is important to be clear with staff and pupils about how any potential misuse will be dealt with.

If your school is considering recording lessons or you have any questions around this topic, a member of our Information Law Team would be very happy to assist, please see our Information Law services for schools.