If one parent clearly objects to their child’s photos being published, the school would be well advised not to publish them, even if the other parent has given consent. Consent can be withdrawn at any time, and you do not have to explain why. Withdrawal takes effect for the future, but it also gives you grounds to demand that what has already been published be erased. And if the school does not respond to the request at all, that is a problem in its own right, because the duty to respond is set by Article 12 GDPR.
Below we answer four questions about children’s photos at school. The answers work for parents and for school heads alike.
Can the school publish a photo if one parent objects?
Publishing a child’s image almost always relies on consent (Article 6(1)(a) GDPR). For a minor, the parents decide as the child’s representatives, and parental responsibility is usually held by both of them.
Article 4(11) GDPR requires consent to be freely given, specific, informed and unambiguous. Once one parent has clearly objected, consent is no longer unambiguous as regards everyone who holds parental responsibility. In that situation, one parent’s signature is not a basis the school can safely rely on.
The practical solution is organisational, not legal. Film and photograph so that the child the objection concerns stays out of the frame, or do not publish those photos. The child must not be left out of the activity because of this: a photo is not needed to take part in an event.
It is important not to read this more broadly than it is. This is about publication. Class lists, education records or health data are processed on entirely different grounds and do not depend on parental consent.
We signed the consent by mistake — can we withdraw it?
Yes, at any time. Article 7(3) GDPR gives the right to withdraw consent at any time and requires withdrawing it to be as easy as giving it.
This leads to something schools should know: if consent was given by signing a sheet at a parents’ meeting or by clicking a button in an online system, it is not permissible to require the withdrawal to be made by a notarised request or on paper only. An unequal withdrawal procedure is in itself a breach of that requirement.
You do not need to give a reason. “We signed without thinking it through” is a sufficient withdrawal.
Does withdrawal take effect immediately, and do photos already published have to be removed?
Withdrawal takes effect for the future: from that moment, new photos may no longer be published, while processing carried out earlier does not automatically become unlawful retroactively.
But that is not the end of the matter, and this is where a misunderstanding can arise. Once consent has been withdrawn, there is no longer a basis for keeping the photo published. Article 17(1) GDPR provides that the data subject has the right to demand erasure of their data, among other cases where consent is withdrawn and there is no other legal ground for the processing. This is the right to demand erasure under Article 17 GDPR, often called the right to be forgotten.
In practice this means: you withdraw consent and, in the same letter, ask for the photos already published to be removed. One request, two demands. The right to demand erasure is not absolute and has exceptions, but school event photos do not usually fall within them.
The school does not reply to our request — is that an infringement?
Not replying is a problem in itself. Article 12 GDPR sets a duty to respond to a data subject’s request without undue delay and in any event no later than one month after receiving it; in complex cases the time limit may be extended by a further two months, with notice given within the first month. The time limit runs from when the request is received by the institution, not from the day it reached the person responsible.
In this area, silence is itself a mistake. The request passes between several members of staff, a month goes by, and the infringement occurs before anyone has even started dealing with the substance.
Where there is no reply, or the reply is unsatisfactory, Article 77 GDPR gives the right to lodge a complaint with a supervisory authority. A complaint is stronger when an earlier written request is attached to it. That is exactly why it pays to start with a letter rather than a conversation in the corridor: a letter fixes the date.
Withdrawing consent cannot cost anything
Article 7(3) GDPR requires withdrawing consent to be as easy as giving it. Article 12(5) GDPR provides that actions taken on a data subject’s request, including erasure under Article 17, are free of charge, except for manifestly unfounded or excessive requests. So no fee may be demanded for removing a photo.
This applies to the school too. If an institution claims that removing a photo from a recording, a promotional publication or a video clip would cost it money, that is its own organisational problem, not a condition for the data subject.
Where the age limit of 14 comes in, and where it does not apply
This is something both sides often confuse.
Article 8 GDPR and Article 6 of the Law on the Legal Protection of Personal Data (ADTAĮ) apply when information society services are offered directly to a child — for example, when the child sets up an account on a social network or an online service themselves. In Lithuania, processing in that case is lawful if consent is given by a child aged at least 14; for a younger child, consent is given or authorised by the holder of parental responsibility.
A school event photo is not an information society service. So the age limit decides nothing here: the parents decide for the child as representatives, and the main question stays the same — whether consent is freely given, specific and unambiguous. The limit matters elsewhere: when it comes to the teenager’s own account and what they themselves can allow to be processed.
What exactly the school should do
- Split consents by purpose: a closed parents’ group, the institution’s website and a public platform are three different purposes.
- Write down how consent is withdrawn, and make that method no harder than the way consent is given.
- Have one address that requests come to, and count the month from receipt.
- Decide in advance what to do when there is no consent or when one parent objects. This decision settles most of the disputes that would otherwise end up in formal letters.
How to start
For parents, the most useful place to start is a single letter to the institution: I withdraw my consent and ask you to remove the photos already published. For the school, the most useful place to start is a review of the consent form, because that is where most of the problems lie.
Write to us and tell us which side you are on and what has already happened. We will tell you which route is most realistic in your case and whether it is worth preparing the request with us. The first reply is free — email info@linden.lt.
You can check whether your organisation needs a record of processing activities with the Privacio tool, built by Linden (in Lithuanian).
More about this service: external data protection officer service.