How many times must a parent/legal guardian consent to the school processing a child's image as the data controller?

ANSWER

If the data controller is the school, the competitions are organised by the school, and the dissemination of the child's image concerns the same means, i.e. on the school's website, on the school's social media profile, in the local newsletter, etc., then a single consent given for the entire school year is sufficient. There is no need to list each competition separately and collect consent on each occasion – that is not the purpose of the GDPR provisions.

A separate consent will be required, for example, when the competition is organised by a different data controller, such as another school (as part of inter-school competitions), and photos of pupils may appear on another school's website. A separate consent will also be required when the location in which the child's image may appear changes, for example if the content of the consent does not cover dissemination of the image in the media, and a television broadcaster wishes to air a programme featuring, for instance, the winners of a given competition.

If, however, consent is given by the same person (parent/legal guardian) to the same controller and the purpose of processing is the same, then a single consent given at the beginning of the school year will be sufficient.