Reporting up
Two audiences outside your network, and only one of them gave you notice
Your authoriser has a schedule. A records request does not. Both of them are asking for material that leaves your network, which is the highest-care category in the whole product — and how well you can answer either is decided by decisions you made long before they asked.
The request that arrives with a clock on it
Public money means a member of the public can ask you for records. A tuition-funded school never faces this, which is the single sharpest difference between your position and an independent school’s.
Whether a photograph of an identifiable student is reachable by such a request is genuinely unsettled. It varies by state, by the specific material, and by how a student’s own education record interacts with the request. We are not going to answer it and you should be careful with anyone who offers to.
What we will say is the part that is ours to say, and it is operational rather than legal. There are two positions an operator can be in when the clock starts, and the difference between them was decided years earlier.
| The question you will be asked | Imagery in folders | Imagery held as records |
|---|---|---|
| What do you actually hold about this student? | A search, and an estimate | A precise answer, because it is attached to them |
| What governs each piece of it? | Whatever anybody remembers | The permission recorded against it |
| Can you answer within the deadline? | Sometimes, at the cost of a week of somebody's time | The answer is a query rather than a project |
| Can you be confident the answer is complete? | No, and that is the uncomfortable part | Completeness is a property of the record, not of the search |
| Does it tell you whether you must disclose? | No | No -- that is your counsel's judgement either way |
The last row is the honest one. Nothing here decides what you must disclose. What it decides is whether you can describe your own holdings accurately while somebody is waiting, and that turns out to be most of the difficulty in practice.
What leaves the network, and how
Anything travelling outside your network sits in the highest-care category by default, whether it is going to an authoriser, a records requester, a partner organisation or a local paper.
The mechanism is the same in every case: material is assembled from the library where the permissions live rather than exported into a folder. What can go into a document is therefore already only what may go into it, and the careful judgement happens once — in the system — rather than every time somebody builds something under time pressure at the end of a quarter.
Where an outside party needs ongoing access rather than a one-off document, that is a specific, revocable arrangement, re-verified each time it is used, created by an adult member of staff in a role that permits it. It can be ended, and ending it takes effect at the next attempt rather than depending on anybody deleting anything.
The unglamorous advice underneath all of this: the fewer standing arrangements a network holds open, the better its position a year later. Every one of them is a thing somebody will eventually have to account for.
How a photograph reaches the right student
A permission-checked lookup against your own roster: a name and an id, scoped to the campus that student is on. Deliberately dull, because your staff already know who was in the room and the interesting alternative costs a stored biometric template for every child in the network.
Face matching exists in the wider platform. It is off unless a parent switches it on for their own child, it is never bundled into a publication permission, and where it is on the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking.
The part we have not finished, in the same type as everything else. Destroying a stored template at the end of its retention window is not something we can demonstrate from one end to the other. So we will not tell you it happens nightly, on withdrawal, or at the end of the window.
What we can tell you is how it fails: the cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it, and that alarm stays where an operator can see it. When the whole chain can be shown, this will say so.
The questions reporting raises
What should actually go to an authoriser?
Evidence that the school is operating as it said it would, which is overwhelmingly counts, states and documentation rather than photographs of children. Where imagery genuinely helps -- a campus in operation, a programme running -- images of the place and the work do the job, and they carry no consent question at all.
Do you produce our report?
No. We hold imagery and what governs it. What we can do is make sure that when your team assembles a report, what they are able to include is already only what may be included -- so the careful judgement happens once, in the system, rather than every time somebody builds a document under time pressure.
A public-records request has arrived with a deadline. What now?
Talk to your counsel, not to us -- what is reachable varies by state and by material. The operational advantage of holding imagery as records is that you can state precisely what exists and what governs each piece of it, which is a fundamentally different position from producing a folder and hoping. Answering precisely and answering quickly are the same problem here.
Can we refuse a request on privacy grounds?
That is a legal judgement for your counsel and it will turn on your state's law and the specific material. We describe mechanism only: what the system holds, what it refuses to publish, and when it re-checks. A vendor offering you a legal position in a brochure has told you something about the vendor.
Our authoriser wants to see the school in operation. Is that a problem?
Usually not, and it is worth separating two things that get conflated. Somebody visiting and seeing children is not publication. Producing photographs of identifiable students for a document that leaves your network is, and it is governed by the same rules as anything else that leaves -- including the age floor, which no reporting obligation lifts.
What have you not finished?
One thing, and it belongs here rather than in a footnote. Where a parent has switched face matching on, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a face. Destroying that template at the end of its retention window is not something we can demonstrate from one end to the other. The cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it. When the whole chain can be shown, this will say so.