Parents are increasingly receiving consent forms for publishing photos of children from educational institutions and sports clubs. Photos may be featured on websites, social media, or promotional materials. Sometimes the decision to sign consent can be somewhat overwhelming, so it's essential to know what to pay attention to.
Firstly, under Polish law distributing a person's image generally requires that person's permission (Article 81 of the Act on Copyright and Related Rights, in Polish), and a school publishing a pupil's photos is also processing personal data. Speaking to Infor.pl, the President of Poland's data protection authority (UODO), Mirosław Wróblewski, pointed out that consent to publication cannot be general and signed once for the whole year: "Processing personal data requires specific consent for a specific image of a pupil at a specific event. The purpose of publication must be clearly defined." He called making a child's participation in competitions conditional on consent to use their image an illegal practice. For the record: the law does not explicitly require separate consent for every event – the UODO guide for schools (in Polish) says the consent should specify, among other things, its scope, the purpose of processing and the period for which it is given. What matters most is that it is specific and voluntary.
So when signing, check the scope: whether it covers only internal materials (e.g. the school newsletter) or also the website and social media, which event it concerns and for what purpose the photos will be used. You can agree to one and refuse another. It is also worth asking your child – the UODO President reminds us that "everyone has informational autonomy. Including the youngest".
Data protection is not only about formal consent but also about how the school or club stores photos and who has access to them. UODO discussed how schools can promote themselves without harming pupils' image rights at a webinar on 28 April 2026 (in Polish) – it is worth asking whether the school knows these recommendations.
Consent can be withdrawn. If it was the only legal basis for processing, you can request erasure of the data – UODO lists withdrawal of consent among the grounds of the right to erasure under Article 17 GDPR (in Polish), but it also notes that this right "is not absolute" (the controller may refuse e.g. on grounds of freedom of expression and information or a legal obligation). In practice this can be difficult once photos are online: the UODO President warns that an image once published can be used in many ways, including to create a fake AI-generated picture (Infor.pl). We cover protecting children's data in our article on children's privacy online.
Parents asking about photo publication should also seek explanations regarding the security of processing these data and information on who will have access to them. The final decision should be made consciously, with full knowledge of the rights and risks involved.
Sources
- Infor.pl, interview with the UODO President on publishing children's photos (in Polish)
- UODO – webinar on pupils' image and school promotion, 28 April 2026 (in Polish)
- UODO – Your rights under the GDPR: right to erasure, Article 17 (in Polish)
- Act on Copyright and Related Rights – consolidated text, Journal of Laws 2025 item 24 (in Polish) – Article 81
- UODO, "Personal data protection in schools and educational institutions. GDPR guide" (2018, PDF, in Polish) – what consent should specify (incl. period and purpose)