From Policy to Practice: Mapping Your Media Management Policy to Daily Operations
Most schools have a media management policy. Most staff have never read it.
That’s the gap this webinar is built to close. Following the response to our session on how AI is changing the way schools handle student photos, James Wigginton and Renee Ramig returned for a deeper look at implementation — the step between writing a policy and actually living it across your school every day.
This is Part 2 of a two-part series. Part 1: How Does AI Impact the Way Schools Manage Student Photos? →
James Wigginton is Head of Data Protection at 9ine, a data privacy consultancy that has assessed over 400 education applications and certified Vidigami among its first group of trusted vendors. Renee Ramig spent her entire career as an educator and IT director before joining Vidigami — she has been using the platform for over ten years. Together, they gave school leaders a frank look at what photo management actually looks like in most schools, and what it should look like.
Policy Locked in a Drawer
A lot of schools have policy, but no one really knows what they are. They’re kind of locked away in drawers somewhere and no one really knows what the policy is.
James Wigginton, Head of Data Protection, 9ine Consulting
James frames media management as a three-layer problem. Layer one is policy — privacy notices, digital media policy, data retention schedules, consent forms. Layer two is process — the workflows, controls, and transparency mechanisms that let staff and families actually follow those policies. Layer three is program — ongoing education for staff, students, and parents, not a one-time annual form.
Most schools have done some version of layers one and two. Almost none have layer three. And without a continuous education program, the policy exists on paper while practice runs on habit, personal judgment, and whatever folder someone created on Google Drive five years ago.
The Cost of Getting It Wrong
I can tell you the one that causes the most emotional charge — and it’s image. Whenever we have a breach with an image with one of our schools, it is always over the top.
James Wigginton, Head of Data Protection, 9ine Consulting
James describes a recent case at a client school: Google Drive folder permissions were set incorrectly, and student photos intended for one group of parents were shared with another. The result was a WhatsApp storm that consumed days of staff time — not because the legal exposure was severe, but because image breaches trigger a disproportionate emotional response. Families don’t weigh photos the way they weigh other data. They feel violated immediately and loudly.
I’ve seen days and half days and two days being taken up just dealing with the breach and the comms and trying to calm everyone down.
James Wigginton, Head of Data Protection, 9ine Consulting
That operational cost — leadership hours, communications time, parent relations damage — is what makes the budget case for centralized media management. A platform that costs roughly $10 per student per year can be spread across four to six departmental budgets: marketing, admissions, advancement, IT, and compliance. Framed that way, the cost of inaction is obvious.
What the Gap Actually Looks Like
Renee Ramig spent years managing photos at her school before she joined Vidigami. Her description of what that looked like is one of the most relatable moments in the webinar.
We had hard drives running around with Sharpie on the front of what these hard drives were. We had flash drives, we had Google Drive, we had Microsoft drives. These photos are all over the place.
Renee Ramig, Director of Customer Support, Vidigami
Managing consent in that environment meant doing it manually. When a student’s family opted out, Renee printed their name on a list. Then, every time a group photo was considered for the school website, she checked it.
I would be doing the website and we get these group photos and I’m there with the magnifying glass going — here’s my list of the opt-out students and here’s my magnifying glass going, are any of these students in this photo.
Renee Ramig, Director of Customer Support, Vidigami
Renee also describes the moment that clarifies why centralization matters more than efficiency. A student at her school passed away. The family asked that all photos of their child be removed from every location immediately. With a centralized platform, that’s one action. Without one, it would have been impossible to fulfill in any timely or compassionate way.
Before and After
- Photos scattered across Google Drive, Microsoft, personal devices, hard drives, and flash drives
- Consent collected once a year on paper, rarely revisited
- Opt-outs managed manually — a printed list and a magnifying glass
- Policies exist but staff don’t know them; families aren’t educated
- Consent withdrawal requests require searching every location — a needle in a haystack
- A single misshared Google Drive folder can trigger days of crisis management
- All photos centralized in one platform with role-based access controls
- Six tiers of opt-out management, synced directly from SIS (e.g., Veracross)
- Any user can report a photo — it’s instantly unshared; admin sees who reported and why
- Slideshow embeds auto-skip opted-out students; can be killed with a single click everywhere
- Watermarks block downloads and disrupt AI image generators
- Consent withdrawal is a single action — not a multi-location search
- Every download triggers a personal-use-only reminder — continuously discharging liability
Rethinking the Legal Basis
One of the more distinctive arguments James makes is about consent itself. Schools treat consent as the gold standard for student image use — explicit, clear, easy to explain to parents. But James argues that consent may no longer be the most honest legal basis in a world where photos get indexed by Google and shared on social media.
You can’t actually fulfill consent withdrawal in its truest sense — because you can’t really stop it if that image is now out there and it’s appearing on Google Images or it’s appearing on social media.
James Wigginton, Head of Data Protection, 9ine Consulting
His alternative: legitimate interest as a legal basis for student image use. This simplifies administration and allows more flexible use of images, but it requires schools to invest in stronger technical protections and document their risk assessments thoroughly. A centralized, access-controlled platform — one that can demonstrate audit trails, watermarks, report functions, and tiered consent management — becomes the practical requirement for that approach to hold up.
Watch the Full Webinar
James Wigginton and Renee Ramig walk through the full policy-to-program framework — including the live Vidigami demo, the consent vs. legitimate interest debate, and Q&A with schools from across the country.
Full Webinar: From Policy to Practice
Video not loading? Try switching between Vimeo and YouTube above.
Your media policy is only as strong as the system behind it.
Book a 15-minute walkthrough and see how Vidigami helps schools close the gap between policy and daily practice — before a breach forces the conversation.