Publishing a photo of a child without consent is a violation of GDPR

Quick overview:

• It is usually illegal for a school to publish a photograph of a child without parental consent.
• A child’s photo is both personal data under the GDPR and an interference with personal rights under the Civil Code.
• The school must therefore have a clear legal basis for publication – typically the explicit consent of the parent.
• A child’s mere attendance at a school event does not replace such consent.
• If there is no consent, you can demand the immediate withdrawal of the photograph and, if necessary, contact the Data Protection Authority.

Are you unsure of the correct action to take against the school? We will be happy to represent you, prepare a challenge or deal with a dispute with the school on your behalf.

The fact that you have given your consent for your daughter to attend a school trip does not necessarily mean that you have consented to the publication of her photograph on the internet. These are two different legal acts – attending an event is different from authorising the school to distribute your child’s likeness.

According to the Civil Code, a photograph in which a child is recognisable is an interference with his or her personal rights and the express consent of the legal guardian is required for publication.

The exceptions allowed by law (such as news coverage) do not usually apply to the school’s regular web presence. From a GDPR perspective, this is also processing of personal data – a child’s photo is personal data and publication on a school’s website is a form of processing for which the school must have a legal basis.

In the case of illustrative and promotional photographs on the website, this is not “compliance with a legal obligation” or “a task in the public interest”, but usually just parental consent.

If you have not given any consent to publish the photos, the school is acting unlawfully. Moreover, when a child is pictured in a swimsuit by the water, it is a more sensitive situation that invades the child’s privacy even more intensely, and all the more reason why the photograph should not be made publicly available without clear consent.

The correct procedure is therefore that the school:

(1) obtain parental consent in advance (e.g. at the beginning of the year) to take photographs, ideally renewed regularly (consent includes the purpose for which the photographs are used),

(2) keeps track of which children and the extent to which consent exists,

(3) prefers not to publish sensitive photos of children (swimsuits, injuries, other more intimate situations) at all, even if she has paper consent.

It is certainly not okay for the principal to justify publication by saying that it is “just a school event” and that you agreed to participate.

In your situation, we recommend that you notify the school in writing that you disagree with the publication, demand that the photo be immediately removed from all public channels of the school, and ask the school to document the specific basis for its consent to the publication.

Even if you signed the consent at the time of enrolment, you can withdraw it at any time, at least for the future; in addition, for particularly inappropriate images (swimwear), you can argue that this is an unreasonable interference with the child’s privacy now.

If the school does not react or insists, it is appropriate to contact the school’s principal and possibly also the Data Protection Authority to complain about the unauthorised publication of a photograph of a minor child.

If you are unsure whether the school is acting lawfully, we can quickly assess the situation and suggest next steps.

Summary

It is generally unlawful for a school to publish a photograph of a child without parental consent. Attendance at a school event is not a substitute for consent to publication. The school must have a clear legal basis under the GDPR while respecting the child’s personal rights under the Civil Code. In the absence of consent, you have the right to request the immediate withdrawal of the photograph and, if necessary, to contact the Data Protection Authority or to pursue the matter through legal channels.