Recent reporting by the i-paper on proposed changes to digital device use in early years settings makes for difficult reading.

The proposals follow a serious safeguarding incident, including the conviction of a nursery worker for abusing children in his care, alongside growing concern about the misuse and theft of children’s images.

The reported measures include restrictions on personal phones in childcare areas, the use of designated work devices for photography, limits on the number of photographs taken, tighter controls over social-media publication and greater scrutiny of how images are stored and deleted.  This is alongside existing advice from the Department for Education helping to protect images published online.

The instinctive reaction may be to ask whether schools and early years settings should simply take and publish fewer photographs.

We think there is a more important question:

When your organisation takes a photograph of a child, do you really understand the information you have just collected and can you control what happens to it afterwards?

That question sits at the intersection of safeguarding, data protection and information security.

A photograph is not just a photograph

Consider an apparently ordinary photograph taken in an early years setting.

It might show a recognisable four-year-old child participating in an activity.

Without a single word of accompanying text, someone viewing that image might potentially determine or infer the child’s approximate age, sex, racial or ethnic background, the nursery or school they attend and their location at a particular time.

The surroundings might reveal considerably more.

A hearing aid, mobility equipment or medical treatment might disclose or suggest health information. Clothing might reveal or suggest religious belief. A classroom display could identify the school, class or year group. Other children could reveal friendships and associations.

The image file itself may also contain metadata created by the device.

One apparently harmless photograph can therefore become a surprisingly rich information record.

Does that make every photograph a high risk or highly sensitive data record under Article 9 special category data?

No, and the distinction matters.

Article 9 of the UK GDPR provides additional protection for particular categories of personal data. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership, as well as genetic data, biometric data used for unique identification, health data and data concerning a person’s sex life or sexual orientation.

A normal digital photograph of an identifiable person is not automatically biometric or Article 9 special category data simply because their face can be recognised. The ICO explains that a digital photograph generally becomes biometric data where specific technical processing is used to create a template or profile for automated identification. (ICO)

There is another important nuance. Article 9 expressly covers personal data revealing racial or ethnic origin, so what an image reveals, and the context in which it is processed, matters too. (Legislation.gov.uk)

Article 9 should not be confused with the protected characteristics defined by the Equality Act 2010. The two regimes overlap, but they are not the same legal classification.

For a school, however, there is a more practical question than simply asking whether a particular photograph crosses a statutory threshold:

What could this image reasonably reveal about this child?

That is where information-security risk assessment becomes valuable.

Protect for the worst reasonable case, not the least sensitive photograph

Schools routinely classify information according to its sensitivity.

We believe identifiable images of children should be approached in exactly the same way.

Not every photograph will contain special category data.

But schools cannot sensibly examine thousands of images individually and decide that photograph A is ordinary personal data while photograph B reveals ethnicity, photograph C suggests a health condition and photograph D potentially reveals religious belief.

Instead, a sensible risk-based approach is to recognise what the dataset could reasonably containand protect it accordingly.

Children’s information already warrants particular consideration. The ICO’s guidance emphasises data protection by design and default and requires appropriate technical and organisational measures throughout the information lifecycle. (ICO)

That leads to a straightforward principle:

Treat identifiable images of children as highly sensitive information assets, even where an individual image does not necessarily meet the legal definition of Article 9 special category data.

That isn’t about inventing another legal category.

It is about choosing a level of protection appropriate to the consequences if the information is misused.

Why a BYOD policy doesn’t necessarily solve the problem

This becomes particularly important when staff use personal devices.

Imagine a member of staff takes an entirely legitimate photograph of a pupil on their personal phone for a learning journal.

The school’s policy may say that the photograph must subsequently be deleted.

But where did the photograph actually go?

It may have been saved to the device’s camera roll. It may have synchronised automatically to a personal cloud account. That account may synchronise to a tablet, laptop or other device. A cloud backup may contain another copy. The deleted image may remain recoverable for a period.

None of this requires malicious behaviour by the member of staff.

It is simply how modern consumer devices are designed to work.

A BYOD policy saying “staff must delete photographs after uploading them” does not give the organisation technical control over all of those copies.

That raises some uncomfortable questions.

  • What happens when the member of staff leaves?
  • How does the organisation demonstrate that children’s images have actually been removed?
  • How does it respond to an erasure request?
  • What happens if the personal device is lost, compromised or shared with another member of the household?
  • What happens when the employee’s personal cloud account synchronises an image to a device the organisation does not even know exists?
  • A policy can establish rules and responsibilities.

A policy cannot magically create technical control over an unmanaged device.

That is why the distinction should not simply be between photography and no photography.

It should be between controlled and uncontrolled processing.

Safeguarding cannot become a box-ticking exercise

There is another danger following a serious safeguarding incident.

Organisations understandably want to demonstrate that something has changed.

  • Ban phones.
  • Limit photographs.
  • Install CCTV.
  • Add another policy.
  • Add another annual training module.

Those actions may be entirely appropriate controls. But none of them, individually, creates a safeguarding culture.

A DBS check is an important safeguarding control, but it cannot guarantee that somebody will never harm a child.

A phone policy can reduce opportunity, but it cannot replace appropriate supervision.

CCTV may provide additional oversight and evidence, but it also creates an enormous new collection of children’s personal information that itself requires protection.

And a policy sitting in a folder provides very little protection if nobody understands it or if working practices have moved beyond what it was designed to control.

The important question isn’t:

“Do we have a policy for this?”

It is:

“Does the control still reduce the risk it was created to address?”

What ISO 27001 taught us about policies

iTCHYROBOT recently completed our ISO/IEC 27001 work.

One of the most valuable lessons wasn’t about firewalls, encryption or technology.

It was about questioning controls.

Policies should not exist simply because a standard, auditor or compliance checklist expects them.

They should describe how an organisation actually manages a risk.

That means periodically asking:

  • Is this policy still accurate?
  • Has the technology changed?
  • Have working practices changed?
  • Do staff understand why the control exists?
  • Does training reflect the real risks people encounter?
  • Can we demonstrate that the control works?
  • What happens when someone leaves?
  • What happens when something goes wrong?

A beautifully written BYOD policy that nobody follows is not an effective control.

Neither is annual safeguarding training that has become something staff click through because they have completed the same slides for five years.

Compliance matters.

But compliance should be evidence that risk is being managed, not the objective in itself.

The same principle applies to school websites

Once an image leaves the classroom and is published on a school website, the risk changes again.

A website is deliberately public.

The objective therefore cannot be to pretend that a published photograph can never be copied. If somebody can see an image, there will always be ways of capturing it.

Instead, we can ask what reasonable technical measures can reduce unnecessary exposure and make misuse more difficult.

That thinking led us to build image-safeguarding controls into the iTCHYROBOT school website platform.

When appropriate, our protected-image delivery process can:

strip image metadata, removing information that does not need to accompany the published image;

reduce image resolution and image quality, providing enough detail for its legitimate purpose without unnecessarily publishing a high-quality original;

apply a digital watermark, making the provenance and intended use of the image more apparent;

and deliver protected images through an HMAC-authenticated mechanism, rather than exposing the original source image directly.

None of those controls makes an image impossible to copy.

And we would be suspicious of anyone claiming otherwise.

They are examples of data protection by design: understanding the information being processed, considering the consequences of misuse and reducing exposure while still allowing schools to communicate effectively.

Perhaps “can we publish this?” is the wrong first question

Schools have traditionally approached photographs largely through consent and publication:

“Do we have permission to use this photograph?”

Consent and lawful processing are obviously important.

But the current debate suggests a broader set of questions.

  • Why are we taking this image?
  • What does it reveal?
  • What device is taking it?
  • Where will the original be stored?
  • Will it synchronise anywhere else?
  • Who can access it?
  • How long will it exist?
  • How will we delete it?
  • What version actually needs to be published?
  • What would the impact be if that image were copied, breached or deliberately misused?

Those are safeguarding questions.

They are data-protection questions.

And increasingly, they are information-security questions.

Safeguarding culture matters more than a camera count

The horrifying cases driving the current discussion deserve a serious response.

Restrictions on personal devices may be entirely proportionate. Better control of photography in early years settings is sensible. Schools and nurseries should absolutely understand where children’s images are stored and who has access to them.

But we should be careful not to mistake a measurable rule – such as the number of photographs taken – for the safeguarding outcome we actually want.

The goal isn’t simply fewer photographs.

The goal is safer children and properly controlled information about them.

That requires safeguarding culture, appropriate supervision, effective recruitment, meaningful training, clear accountability and technical controls designed around the way modern technology actually behaves.

And perhaps one of the most useful lessons information security can contribute to safeguarding is a very simple one:

Protect data according to the harm it could reasonably cause and identify protection that is manageable and reduces the risk of any identified harm. 

For identifiable image(s) of a child, that deserves serious consideration.

Nursery staff to be banned from using phones after ‘chilling’ child abuse case