How schools can avoid liability over the misuse of their photos

Photographs have always been used by schools to showcase school life, celebrate pupil achievements and communicate what makes their school special.

But the growth of AI, social media and the internet means the risks associated with publishing images has reached a new height.

Images can now be downloaded, copied, manipulated and redistributed in minutes, presenting risks that simply did not exist even just a few years ago.

It’s one reason why in July the Department for Education strengthened its advice to schools, expanding its guidance around the taking, use of and publication of photographs and videos in schools.

The guidance was updated to reflect recent changes implemented by the Data (Use and Access) Act 2025.

It was also revised in line with the UK Safer Internet Centre, which updated its own guidance in May with warnings about the misuse of images posted online, and suggested practical steps for schools to follow.

The risks of schools publishing pupil photos

Such risks are becoming very real. For example, in May the Internet Watch Foundation highlighted the attempted blackmail of a UK school using website images that had been turned into child sexual abuse material.

Currently such occurrences are few and far between, but the risk is there and, as technology becomes increasingly sophisticated, incidents are expected to become more prevalent.

As such, schools are becoming increasingly concerned about what their liability would be in such situations, given that they are the ones that would have published the image into the public domain.

The reassuring starting point is that if a school publishes a photograph legitimately and a third party then subsequently takes that image and uses it illegally, the school is not automatically liable for that misuse.

In most cases, liability will depend on whether the school acted lawfully, reasonably and in accordance with its safeguarding and data protection obligations when the photographs were originally published.

More on this issue: ‘Why our school stopped posting photos with pupils’ faces’

As photographs constitute personal data, their use must comply with data protection legislation.

This means that schools must have a lawful basis for publishing images and be clear and transparent with pupils and parents about how photographs will be used.

How liability issues can arise

Safeguarding considerations are also important, and schools should check whether there are pupils who must not be publicly identifiable before publishing photographs.

They should also consider the information accompanying an image and whether combining a pupil’s photograph with their full name, location or other identifying information creates an unnecessary additional risk. This is where potential liability becomes more nuanced.

If a school has acted lawfully, followed appropriate data protection and safeguarding procedures and could not reasonably have foreseen the criminal misuse of an image, the fact that somebody has scraped it from its website would not, by itself, necessarily mean the school has breached its obligations.

If, however, the school has failed to follow its own procedures, published an image without an appropriate lawful reason, ignored a parent or pupil’s objection or published photographs despite known safeguarding concerns, liability could be established.

The consequences of this can include regulatory action, compensation claims, negligence claims and, of course, reputational damage.

Demonstrating best practice

There are several steps schools should take to demonstrate best practice and reduce their exposure to risk.

The first is to ensure that there is a clear and transparent written policy in place, covering photography, filming and the use of photographs across websites, social media platforms and marketing materials.

The policy should be circulated to parents, carers and staff at the start of each academic year, providing an opportunity for consent preferences, objections and safeguarding concerns to be identified, recorded and reviewed.

Schools should then ensure that all preferences and restrictions are recorded and that staff know which children must not appear in photography.

It is also good practice to introduce a simple approval checklist for staff to work through before anything is published.

This can help whoever is responsible for the website or social media to establish that appropriate consents have been obtained, safeguarding risks have been assessed and publication is consistent with the school’s data protection and safeguarding obligations.

Schools should also regularly review photographs that are online and remove images that are no longer needed so that less pupil data is available.

Ultimately, schools can’t eliminate the risk of a third party misusing an image published online, but they can minimise their own exposure by ensuring that they have robust policies, appropriate safeguards and clear decision-making processes in place.

Tina Morris is a director in the education team at law firm Schofield Sweeney