The school of my child wants to store photos in the pupil record and place them on the website. Is that allowed?

No, that is not allowed without a good reason. Sometimes, a school wants to make and publish visual material of pupils. For example, in the (online) school paper, a facebook, or the pupil record. The school needs consent for this.

If a pupil is 16 years of age or older, the school will have to ask the pupil for consent. Is the pupil younger than 16 years? Then the school needs consent from you as a parent. It does not matter how the school asks for consent. The school must in any case be able to demonstrate that consent was given. Withdrawing consent must be as easy as giving consent. Tip: use the model letter (in Dutch) for this purpose.

A school has to secure the photos properly. Especially where it concerns minors. For example, by making access to photos on a blocked part of the school website conditional to the use of a password.

Privacy rights

Just like you, your child has certain privacy rights (in Dutch). For example, your child may ask organisations for access to, rectification of or removal (erasure) of personal data (such as the data in the pupil record). From the age of 16, your child may exercise these rights itself.

Do you think the school has not made proper arrangements regarding consent, security or privacy rights? Then enter into a dialogue with the school first. If this does not solve the problem, you can submit a complaint to the Autoriteit Persoonsgegevens (AP).