There should be a feature for disabling the Photo upload on the learners profile or strip off the metadata from the uploaded picture.
RECAP
Many image types (JPGs, HEIFs, TIFFs, …) contain a small database to store specific data related to the image. This is EXIF and IPTC-data. The latter is more used in professional context, while the former is used extensively by most modern cameras.
This data may include GPS coordinates (EXIF) as the most critical one, as well as basically unspecified data in IPTC which may contain personal data. This extends further to e.g. the filenames which may contain the owner’s name, location, phone number, … Let us call this all metadata.
IMPACT PRIVACY
When someone is uploading an image with metadata:
We are collecting and storing personal information without a business need. We are not using it, so I don’t see processing.
IMPACT CYBER SECURITY
In case of a hack, that metadata can also fall into the hands of the attackers. This goes beyond the theft of already available profile data, as locations of homes and views of interiors of their homes may be included. Profile data, name and face image can further be used to link to e.g. Facebook, and create a list of targets to be sold on the Darknet, now with location.
Metadata which is not cleared may contain malware to prepare or execute an attack when the image is opened and metadata processed.
Data privacy and cyber security go here hip to hip again, as mentioned.
