Just picked up this thread when looking for something else.
The major problem here is that the DPA in relation to photography is largely untested in the courts.
The ICO (and anyone else) can set out their opinion, but until the courts have ruled on a matter like this, then their interpretation of the law is only that, an untested interpretation.
• Photos taken purely for personal use are exempt from the Act.
emphasis added - presumably the photographer got paid for his work, so it's not purely personal use.
First up: is a photograph personal data? Secondly, do subject access provisions apply?
ICO Data Protection Technical Guidance:
Determining what information is ‘data’ for the purposes of the DPA
published January last year, and referenced in a recent
ICO consultation for a Code of Practice on online information*, which has received a fair bit of attention elsewhere precisely because it
does state that photographs, especially digitally recorded ones, are covered by the DPA, though this is not entirely novel when you look back over the last ten years.
Information Commissioner's Office said:
3.2 Non-text information (sound and image information)
Sound and image information may be captured by a variety of means, the most common of which are recordings on photographic film or magnetic tape or the digital capture of sounds or images.
(a) Still images produced from photographic film
In order to be viewed a still image captured on photographic film must be developed and then usually printed and retained as a photograph. The processes involved in capturing and creating the hardcopy photograph may involve the use of highly sophisticated technical equipment. However the resulting photograph, without further action (such as scanning or other image capture), is not automatically processed.
Hardcopy photographic images may nonetheless still be ‘data’ for the purposes of the DPA where they are retained with other information in a ‘relevant filing system’ (discussed in sections 3 to 6 of the main body of this guidance) and thereby may also be personal data for the purposes of the DPA.
Whether the individual whose image has been captured may exercise his right of subject access in relation to a photograph will depend on whether the photograph is held in a relevant filing system.
(b) Sounds and images held in an automatically processed form
Still and moving images and sounds are recorded for a variety of purposes. Where recordings are made to record social or domestic activities it is likely that the DPA ‘domestic purposes’ exemption will apply to the processing. In contrast, where recordings are used in a professional or business context the provisions of the DPA are likely apply in full.
Emphasis added - subject access is the right or persons to access personal data held by a data controller under the DPA.
I'll also assume that the photographs were taken digitally and/or filed/tagged against the name of the pupil.
I'm erring toward the opinion that, in the circumstances outlined in the OP, it the photographs are probably not exempt under 'domestic purposes', which would then allow access to the data under the DPA.
However...
Give them a 240x160 image on a CD charge the statutory fee for info £10 I think
Would probably cover it, provided that the 240x160 image was sufficient to
- identify the individual
- demonstrate any significant editing that had taken place (fourth principle of Data Protection that information held should be 'accurate and up to date', which opens a whole can of worms in relation to post-processing)
Bear in mind that you would have to supply all the data you hold on the data subject [i.e the child], so not just the 'pick' published shot(s) but any others you retain where the child was blinking/gurning, etc.
A useful run-down on the DPA and photography here (published in Jan 2005)
http://www.jiscdigitalmedia.ac.uk/stillimages/advice/data-protection/
* the topic I was actually looking for when I found this thread
