Can my child’s school publish photos and share pupil data?

Split what schools do into three lanes. Publishing photos — website, newsletters, social media: this is not necessary for education, so it runs on consent: informed, per child, freely refusable, revocable at any time, and refusal may not cost your child anything (a child excluded from the class photo as “punishment” for a privacy choice is itself a complaint). From roughly the mid-teens, national rules increasingly require the pupil’s own consent alongside or instead of yours. Core school administration — enrolment, grades, attendance, safeguarding files: no consent needed (legal task basis), but strict necessity, retention limits and your access right to your child’s file apply. EdTech platforms — the quiet battleground: schools pushing pupil data into US-based classroom suites, video tools and AI tutors have drawn DPA scrutiny in several countries (German and Danish authorities most famously); schools must vet vendors via data-protection impact assessments, and you may ask to see the outcome and which processors receive pupil data (Art. 13/15). Other parents filming school plays is the classic flashpoint: personal filming for family use is the household sphere; posting other people’s children publicly is not — the school setting rules for events is doing everyone a favour. Escalation path: school data officer → school authority → your DPA; education cases get handled, they are politically visible.