Why can permission to publish an image be indefinite, whereas consent cannot?

ANSWER

In practice, permissions to disseminate an image are often marked as having an "indefinite" duration, because the entity obtaining permission then does not have to specify concrete time limits. This does not mean, however, that the image may in fact be disseminated indefinitely. The person who granted permission has the right to withdraw it. Their image may then no longer be processed further. Where possible, it is therefore better to specify the period of dissemination in the permission obtained, e.g.: this permission is valid for the duration of the employment contract or civil-law contract linking me with …, and also for … years from its termination or expiry in any manner.

As regards consents to processing of personal data obtained under the GDPR, the consent in question does not have to include in its wording a term for processing data on its basis, but the controller, in view of the storage limitation principle set out in Article 5 GDPR, must define retention periods for processed data, including data collected on the basis of consent. If, for example, a controller obtains a candidate's consent to participate in future recruitment processes, this does not mean that it may process those data indefinitely if the candidate does not withdraw consent. The controller should define deletion periods for all processed data (as short as possible, so that data are processed only for the period necessary to achieve the purpose for which they were collected) and, after those periods expire, delete data in respect of which the processing period has ended.