This year has been really tough and I’m sure we are all counting the days to 2021, yet there is an important topic I’d like to quickly touch on before the New Year – already being labelled the ‘Year of Consent’ – and that is the term meaningful consent.
2020 may have shown us all how critical privacy protection is during a pandemic, especially when it comes to our children, but an organisation that wants to build trust with its customers or members in 2021 will need to ensure it collects their personal data in a meaningful way and uses digital channels and technology with privacy by design front and centre.
You may have missed the recent news that the maximum penalty for entities who mishandle consumer data under Australian Consumer Law increased by almost 500% to A$10 million. A similar penalty will follow shortly for general privacy breaches coming out of an Australian Government review of the Privacy Act.
The review of the Privacy Act will help ensure that our regulatory framework can protect personal information into the future and hold organisations to account. Issues such as consent requirements, additional privacy rights, accountability measures and the Privacy Act’s coverage are fundamental to how we address the privacy challenges of the future.
Australian Information Commissioner and Privacy Commissioner, Angelene Falk
How to avoid a $10M penalty
A way to avoid such penalties is to collect ‘meaningful consent’. The annual Deloitte Australian Privacy Index report this year dedicated its entire content to this topic, boldly announcing:
Meaningful consent should now be front and centre for every industry and every sector.
Personally, I was always confident that this day would come. Back in 2016, our company took a huge leap of faith by pivoting our service using Privacy-by-Design methodology – meaning we built privacy into the design and architecture of our platform.
We invested heavily in a tech privacy business as we wholeheartedly believed families wanted to protect their children online as much as they do offline. For us it was to create a safer alternative to social media channels… yet people would say “Are you crazy?”, “No one cares about privacy anymore – just give up!”. Call us stupid, but we did not give up and neither will the subject of consent… consent = control & choice, which is the backbone of our society.
If you are currently responsible for managing personal data, (including photos and videos), at a school or child-focused organisation, (i.e. dance school, drama school, gymnastics club), and you haven’t thought about your existing consent collection practices, you are likely participating in unlawful consent practices and need to make a change now.
Around the world the collection of meaningful consent is an essential ingredient of regulated privacy practice, and let’s be honest, it really doesn’t take much to get it right – it takes far more effort to practice the dark art (or dark pattern) of consent! A term often associated to big tech consent practices.
What is meaningful consent and how is it collected?
Meaningful consent is where you give your customers or members sufficient information to respond to consent in a meaningful way. The key part of being meaningful is to empower people to choose if and how they want to participate.
So, to collect meaningful consent, you need to:
- Give choices as an expressed opt-in
- Give sufficient information to allow a person to make an informed decision
- Be specific enough as to the purposes for which the personal information will be collected, used and disclosed
- Not bundle it with other requests for consent
- Not provide conditions where there is no other choice (i.e. if you don’t say yes, your child cannot participate or enrol)
To collect meaningful consent and make it actionable, an organisation needs to enable ‘consent self-management’ so individuals can exercise their own choice and control. This is the heart of what our system does.
In fact, the Deloitte report listed 4th in the Top 5 steps in collecting better consent is to “create an online portal for users to monitor and change their consents”, making it easier for them to access, understand and use consent. This increases transparency, individual control, and obviously trust – enabling your organisation to demonstrate you take consent seriously.
Are you only collecting photo consent at enrolment or registration?
How is your school or organisation collecting photo consent today? Is it captured only once? Is the process mainly manual or are you able to attach consent directly to the right assets or files that people have given permission or restriction to use? How easy is it to filter your media collections based on consent? Can you give your customers or members easy access to your consent process so they can monitor and change their consent as needed in real-time?
As part of our image privacy consulting service we provide to our schools, we are asked regularly if it is ok to collect photo consent only at enrolment: meaning consent to use student photos is only collected once during a student’s 6 to 13-year period of school life and bundled with other consents even before their life at school begins. This is a problem because it is impossible for consent to adapt and change to a person’s personal situation if only captured once – it is like never going back for a check-up with your doctor after the initial consult.
A core reason why school photo consent, in particular, should be kept up-to-date and not bundled with other consents is to ensure a school clearly articulates to its parent community the primary intentions and purposes it has for student photo and video use (i.e. specificity) – beyond education – so that parents are informed about what they are consenting to, it remains voluntarily (not coercive or compulsory), current and reflective of every family’s personal, private situation which can evolve dramatically year on year.
Do not bundle photo consent
This recommendation is also supported by key Australian School Associations:
that consent is freely obtained and is not hidden in lengthy documents or as part of multiple requests for an individual’s consent to a wide range of collections, uses and disclosures of personal information. Individuals should have the opportunity to choose which collections, uses and disclosures they consent to (where consent is required). The practice of obtaining bundled consents has the potential to undermine the voluntary nature of a consent.
Right now, common practice at many schools is to only collect photo consent on enrolment, often due to convenience, however, the good news is there is a trend towards schools moving away from such poor consent practices heading to the end of 2020 – perhaps due to this pandemic and online privacy becoming the OH&S of this decade?
And it is not only individual schools or organisations that are required to collect student photo consent, its Education Departments, Corporate Head Offices or Diocese that also have planned intentions to use these photos for purposes beyond learning. How can such large ecosystems do this well without keeping consent active and using an online portal for members to access and manage their consent?
Schools realising the importance of collecting meaningful consent for student photos and videos using our pixevety platform has made us the trusted platform for many school portals around the world, helping to clearly demonstrate student image protection is a high priority. Acting as a school’s trusted contracted service provider allows us to provide the school community with a secure internal channel to filter (on consent) and privately publish all school media content without giving it away to third-parties, like Facebook, Instagram, YouTube and Google, who are known to keep and use these images forever! pixevety not only assists schools in the management of tens of thousands of student photos and videos taken each year on school grounds, but we are the only provider who supports the online collection of meaningful consent from parents/legal guardians, in real-time, so student images can be easily searched, found and filtered based on permissions, then used appropriately by all staff and the parent community, making sure the consent wishes of every parent and student is adhered to.
Time to get ready for the ‘Year of Consent’!
Right now, the Australian Privacy Act is under review and the OAIC has already stated that “The practical application of concepts of fairness and the role of consent will be central to the future of privacy in Australia”.
If you are a business responsible for handling photos of children, please place the meaningful consent capture on your top priority list for 2021 and help to better protect children online.
I hope, too, I have encouraged many child-safe organisations to stop the poor practice of collecting photo consent only at enrolment or registration stage – this approach will not reflect a duty of care.
