R093 TA3: Legislation, Copyright and Permissions

A trade mark, and a patent.

Any photograph is protected by copyright from the moment it is taken, and the copyright belongs to the photographer whether or not the image carries a symbol, a watermark or a credit. Appearing in search results is not permission; it only means the image is published somewhere. Using it commercially without a licence is infringement, and the rights holder can demand payment, force the product to be withdrawn or pursue damages, which for a printed product means the whole run is wasted.

The college needs written consent from every student who is identifiable in the video, because an individual's image is personal data and they have a right to object to its use; consent also has to cover where the video will be shown, since agreeing to appear in an open day screening is not the same as agreeing to appear in a social media advert. For students under 16 that consent must come from a parent or guardian, because a child cannot give informed consent to publication and the college has a safeguarding duty as well as a legal one. The chart recording needs a licence from the rights holders, and in practice that means two permissions, one for the sound recording owned by the label and one for the underlying composition owned by the writer and publisher. Those licences are expensive and often refused for promotional use, so the realistic solution is production music or a Creative Commons track whose licence permits commercial use.

The business has duties in four separate areas, and all of them apply to this one website. Every asset on the site, the photographs, the fonts, any music and any icons, must either be the business's own work or be covered by a licence that permits commercial use, since the site sells products and is therefore unambiguously commercial; a non commercial Creative Commons licence is not usable here. The customer photographs need written consent from each identifiable person, specifying that the images will be used for marketing on a commercial website, because consent for one use does not transfer to another. Collecting email addresses brings the Data Protection Act 2018 and the UK GDPR into play: the business must say in a privacy notice what it collects and why, collect only what the newsletter actually needs, store it securely, provide a working unsubscribe link, honour requests to see or delete the data, and report a serious breach to the ICO within 72 hours. Because it provides a service to the public, the Equality Act 2010 requires reasonable adjustments, which in practice means the site must be usable with a screen reader and a keyboard and must meet contrast requirements. Finally the product claims and prices must not mislead, which is enforced by the ASA and by consumer protection law. The consequences differ sharply in scale. An unlicensed image typically produces a demand for a licence fee and a takedown, which is embarrassing but survivable. An inaccessible site risks a complaint and the loss of customers who cannot use it. A data protection failure is the most serious of the four, because the ICO can impose penalties calculated against turnover, the obligation to notify makes concealment itself an offence, and the business would be publishing its own breach to the customers it depends on. The practical conclusion is that the data the site collects, rather than the content it displays, is where the greatest risk sits, so the privacy notice and the security of the mailing list deserve attention before launch rather than after.