School prom photos and GDPR: a safe way to let pupils share

What does data protection law say about prom photos?

The Department for Education’s guidance on photos in schools is the clearest place to start, and it is shorter than you might fear. In summary:

• Photos of people who can be identified are personal data, so a school needs a lawful basis to take, use or share them. The guidance names public task, consent and legitimate interests.
• Consent has to be real: freely given, specific, informed and unambiguous, and it can be withdrawn at any time.
• Personal photos are usually outside it. Data protection law does not usually apply when people take and use photos for personal use, which covers a parent photographing their own child.
• Sharing publicly needs more care. Social media in particular, and pupils who should not be identified, for safeguarding reasons, should not appear in published images.
• Pupils have a say. When pupils can understand how their images may be used, often at around the age of 13, it is good practice to ask them directly.
• Photos must be stored securely and disposed of in line with the school’s retention policy.

This is a summary, not legal advice. Your school’s data protection officer and your own photo policy decide how it applies to you; the guidance itself is linked in the sources below.

Why is the group chat the real risk?

Prom photos will be taken whatever the school decides. The question is only where they end up. Left alone, they spread through year-group chats and public profiles, where nobody can check them, nobody can take one down, and a pupil who should not be identified can appear in a stranger’s feed by Sunday morning.

One album the school runs does not stop anyone keeping their own photos, and it should not. It gives the photos people want to share a better home: one with rules, a person in charge, and a way back. If the alternative is a parents’ WhatsApp group, a WhatsApp group or Mosaikin sets out where each is the better tool.

Who is responsible for the photos in the album?

Mosaikin’s Privacy Notice states that we are the data controller for the personal data processed on Mosaikin, registered with the Information Commissioner’s Office. A guest’s photos and messages rest on their consent, given at the moment they contribute and withdrawable at any time. Before a first upload, each contributor is shown a short notice saying exactly what will be stored and shown.

The member of staff or volunteer who creates the event becomes its host: they decide who can open the gallery, who helps moderate, and what is hidden or deleted. What the school then does with the photos, on its website or a newsletter, is the school’s own use, and its own photo policy applies to that. Trust and safety sets out who runs Mosaikin and what we hold.

Can pupils upload their own prom photos?

Pupils aged 13 or over can, and under-18s should have a parent or guardian’s agreement, as the Guest Terms say. Be clear about what that is: a term, not a check. Mosaikin asks nobody their age and holds no date of birth, so the school’s own arrangements, and who it gives the access code to, are what decide who takes part.

Pupils are not given an account, are not asked for an email address and are not signed up to anything. A session links their phone to the one event and lapses after 24 hours. There is no messaging between guests, no profiles, no followers and no feed, so nothing on Mosaikin can reach a pupil after the night. See My child is at an event that uses Mosaikin: what should I know?

What keeps the album safe on the night?

• A private gallery. It opens only for the host, their moderators and people who have joined with the event’s access code; the link on its own shows nothing, and the refusal happens on the server on every request. See What do the three privacy settings mean?
• Checked before it can appear. Every photo and message is held until it has passed a safety check, and anything the check is unsure about waits for a person.
• A member of staff publishes each photo, with Require approval on, so nothing reaches the gallery or the screen until it has been seen. That is how a pupil who must not be identified stays out of it. See What does “Require approval” actually change?
• Location data stripped from every photo before a servable copy exists.
• No facial recognition and no biometric profiles, anywhere in the product.
• Anyone can report a photo from the photo itself, without an account, including a parent whose child appears in it. Deleting a photo removes its stored files, with no bin.

Pupils have their own page, in plain words, on what to do if something upsets them: I’m under 18 and something upset me. The fuller account of how safety works is on Safety and child protection.

What happens to the photos afterwards?

Decide this before the night, so it matches your retention policy. You can tighten the gallery at any time, from protected to private, and the change applies at once, even to people who already had the link. On an upgraded event the host downloads every photo as one file, cleaned of camera metadata, to keep under the school’s own policy.

When the school no longer needs the album, delete the event from its Settings. It disappears at once, and its photos, messages and stored files are erased for good seven days later, or once any open report on it is settled if that is later. See How do I delete an event? A free event is kept for six months after the event date, as the Host Terms set out, and you are emailed before it is removed.

Creating an event is free, with up to 30 photos; a year group usually needs more, and the pricing page shows each plan’s allowance. Everything else about school events is on school events on Mosaikin.