During the Easter break I managed to get some time away spending some of it in Norfolk. Now this required a trek across the country, which therefore necessitated a brief stop in a motorway service station to avail myself of the facilities, grab an Irn Bru or two and something to eat. This isn’t where you would expect a blog piece to jump out, but it was as I was eating in one of the well-known beverage and food establishments that a data protection issue struck me.
Data Protection training is something we all receive, and I say that not just in terms of education but in terms of other organisations such as the care sector, leisure sector, retail and service industries too. Sadly, the problem, in my view, with such training is that it tends to be focused on answering the compliance question of “have we provided training to staff?” So, providing an online platform with a data protection training video which staff have to do annually is an easy way to make sure the box is ticked. Did the staff member get to the end of the video; yes, job done. Or maybe, did they get to the end of the video and did they answer correctly a couple of multi-choice questions, where they could simply retry the same questions if they got it wrong; yes, job done.
The much more difficult question is “are staff trained, and aware of data protection?” This goes to have they actually learned about it and understand it. This isn’t so easy a question to answer, but I believe is the question we should be asking rather than making staff waste 1 hour or so every year sitting in front of a video (note: not learning from or being trained) which results in little to no learning. Workload is an issue across many sectors so wasting staff time to tick a box but with no real value makes no sense to me at all.
So, what was did I see that led to the above? Well, it was basically a lovely big brand mascot; You know the person in the big teddy or animal suit which kids love. Parents were getting the opportunity to photograph their children with the mascot, with these being very popular among the large number of children in the service station on the easter bank holiday weekend. No problem so far. The issue for me however was the managerial staff, suited and booted rather than in the branded tops of your average server, also taking photos of the kids with their mascot. They were accompanying the mascot as it went round the service station, taking photos of each child with the mascot. The only reason I can see for them taking photos is for marketing purposes, heaven forbid I consider any other possibilities. But for marketing, they are taking photos of children, without having asked permission or anything from the parents. What’s there legal basis for processing the photos, which I would say present personal data? And what about the safeguarding risk in relation to young children? How might the images be used, and how long might they be retained for, who has access and more?
I suspect all those involved have a tick against the data protection box, but based on what I saw, and based on my views on compliance based training, maybe we need to take a different approach.
(and please note, the photo was AI generated; hmm, but were any photos taken without permission by staff used in the training data of the genAI tool….I don’t know and I suspect that’s a blog piece all of its own!)
Technology and Learning