Publishing a photo of a child without consent is a violation of GDPR

No, it can’t work that way. Just because you have given your consent for your daughter to attend a school trip does not mean that you agree to publish her photo on the internet. These are two different legal acts – attending an event is different from authorising the school to distribute your child’s likeness.

According to the Civil Code, a photograph in which a child is recognisable is an interference with his or her personal rights and the express consent of the legal guardian is required for publication. The exceptions allowed by law (such as news coverage) do not usually apply to the school’s regular web presence. From a GDPR perspective, this is also processing of personal data – a child’s photo is personal data and publication on a school’s website is a form of processing for which the school must have a legal basis. In the case of illustrative and promotional photographs on the website, this is not “compliance with a legal obligation” or “a task in the public interest”, but usually just parental consent.

If you have not given any consent to publish the photos, the school is acting unlawfully. Moreover, when a child is pictured in a swimsuit by the water, it is a more sensitive situation that invades the child’s privacy even more intensely, and all the more reason why the photograph should not be made publicly available without clear consent.

The correct procedure is therefore that the school:

(1) obtain parental consent in advance (e.g. at the beginning of the year) to take photographs, ideally renewed regularly (consent includes the purpose for which the photographs are used),

(2) keeps track of which children and the extent to which consent exists,

(3) prefers not to publish sensitive photos of children (swimsuits, injuries, other more intimate situations) at all, even if she has paper consent.

It is certainly not okay for the principal to justify publication by saying that it is “just a school event” and that you agreed to participate.

In your situation, we recommend that you notify the school in writing that you disagree with the publication, demand that the photo be immediately removed from all public channels of the school, and ask the school to document the specific basis for its consent to the publication. Even if you signed the consent at the time of enrolment, you can withdraw it at any time, at least for the future; in addition, for particularly inappropriate images (swimwear), you can argue that this is an unreasonable interference with the child’s privacy now. If the school does not react or insists, it is appropriate to contact the school’s principal and possibly also the Data Protection Authority to complain about the unauthorised publication of a photograph of a minor child.