The short version
When a student or parent withdraws consent, Beeldbank.nl's face recognition finds all images of that person within seconds. Mark the person as 'geen toestemming', hide images automatically, use face recognition to search, decide what to delete or replace, and trace published copies. This article walks through the workflow and its legal basis under GDPR Article 7(3).
Monday morning, your school receives an email: a parent has decided to withdraw consent for their child's image to be used in school publications. Over the past three years, the child has appeared in many photos: class pictures, sports day, graduation, the school newsletter from last September. Your communications team now faces a familiar problem: find every photo where this child appears, make sure none of them is used any longer, and work out which publications need attention. Without a proper DAM system this takes hours, and the risk of missing one photo is real. Beeldbank.nl lists face recognition as a core function that finds all images of one person within seconds.
This article walks through the workflow, step by step, explains what Beeldbank.nl offers for each step, and covers the legal basis behind consent withdrawal.
Step One: Set the Person to No Consent
In Beeldbank.nl, consent can be withdrawn at any time. When a parent or student asks you to stop, you set the person to "geen toestemming" (no consent). From that moment, the images in which that person is recognisable are no longer used. That is the first decision the system records for you. The next steps are about finding every image the person appears in and deciding what happens to each one.
Step Two: Hide Images Without Valid Consent Automatically
Beeldbank.nl can automatically hide images without valid consent. With the setting "Beelden zonder toestemming automatisch verbergen" switched on, those images are not visible in the normal overview. The system also links consent forms to the people in the image and makes expiry dates configurable. This setting is a safety net for everyone who browses your archive. A colleague who searches for an image of the sports day does not have to remember who withdrew consent last week. Check in your own setup that the setting is switched on before you rely on it, and test it with one person before the first real request arrives.
Step Three: Use Face Recognition to Find Every Photo
Hiding images only works if the system knows which images show the student. This is where face recognition becomes essential. Beeldbank.nl states that face recognition finds all images of one person within seconds. The system explains why this matters: "Dankzij gezichtsherkenning vind je bovendien alle beelden van één persoon terug. Trekt iemand zijn toestemming in, dan weet je precies welke beelden je moet verwijderen of vervangen." Thanks to face recognition, when someone withdraws consent you know exactly which images to delete or replace.
Without face recognition, you would scroll through folders by hand, relying on memory and file names. With it, you search by person and get a list within seconds. Educational institutions can also search by branch, school year, department or file type in Beeldbank.nl, which helps when a school has several locations and many years of photos. Face recognition gives you a list to work from. A person still has to look at the result, especially for group photos and for images where the student is hard to see. Face recognition provides a complete list for review. A person should verify the results, especially for group photos and images where the student is hard to see.
For detailed guidance on setting up a school group's consent management with search by school year, Image Bank for a School Group walks through the same requirements. If you work with mbo or roc institutions, Mbo and Roc Image Management covers the same workflow in those contexts.
Step Four: Decide What Happens to Each Image
Once you have the list, review each image against the request you received. Typical decisions are: delete the image if nobody needs it any more; replace it with a different image of the same occasion in which the student is not recognisable; or keep it stored but not used if your own policy and the request allow that. Beeldbank.nl states that if someone withdraws consent, you know precisely which images to delete or replace. What you do with each image is a decision for your school, based on the request and your own privacy policy.
Step Five: Handle Copies Published Outside the Archive
An image bank only controls what is inside the image bank. Copies that were already published on a website, on social media, in a printed newsletter or in a presentation sit outside it. Use the list from face recognition to trace where those images went, and then handle each channel yourself. For guidance on consent withdrawal across different sectors, DAM for a Hogeschool Communication Department covers the same workflow in hogeschool settings, and Consent Withdrawal for a Charity shows how the process works in nonprofits.
Make a short checklist for this step: Which web pages and social posts use the images on the list? Which printed or mailed items contain them, and have they already been distributed? Who has the authority to remove or replace each item? Who tells the parent or student what has been done?
The Legal Basis for Consent Withdrawal
This workflow rests on GDPR Article 7(3), which states: "The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal." Two points follow from that text. First, a request to withdraw consent is a right, so it is not something you can refuse because consent was given earlier. Second, withdrawal is not retroactive: processing that was lawful at the time stays lawful. The GDPR does not itself prescribe how published copies must be removed, so your school has to decide that, ideally with its data protection officer. This is not legal advice.
The Dutch Chamber of Commerce (KVK) says the same in its guidance on images: members or donors have the right to withdraw their consent again. The KVK does not say how long images may be kept or what happens to copies that were already published, so those questions remain with you.
Common Scenarios and How to Handle Them
A student graduates and withdraws consent. Set the person to no consent, run the face-recognition search, and review every image on the list. Decide per image whether it is deleted or replaced, and check your alumni pages and social channels for copies. A parent asks for removal after seeing their child in a newsletter. Handle that request first for the newsletter, then use the same search to find the other images of the child. Tell the parent which steps you took. A student moves to another school. Whether consent still applies is a question for your own policy and the consent you collected. If the student or parent withdraws it, the workflow above applies in the same way.
Verify the Workflow Before You Need It
The time to find out whether the workflow works is before the first withdrawal arrives. Run a small test with a colleague who has agreed to take part, and keep the results in a table like the one below. Check that face recognition finds images in group photos and from older years, and that the hiding setting works as expected.
| Step | What Beeldbank.nl Offers |
|---|---|
| Withdraw consent | Set the person to "geen toestemming" so images are no longer used |
| Hide images | Automatically hide images without valid consent when the setting is switched on |
| Find images | Face recognition finds all images of one person within seconds, including group photos and older images |
| Narrow the search | Search by branch, school year, department or file type |
| Handle outside copies | Document all channels where images were published and update them separately |
Questions people ask
- How does face recognition help find photos of a student?
- Beeldbank.nl lists face recognition as a core function that finds all images of one person within seconds. That gives you a list of the images to review. A person should still check the result, especially for group photos, before deciding what to delete or replace.
- What happens to photos on social media after consent is withdrawn?
- Beeldbank.nl can hide images without valid consent in its normal overview. Copies that were already published on social media or external websites sit outside the image bank, so you have to trace and handle those yourself. The face-recognition list tells you which images to look for.
- Is consent withdrawal retroactive under the GDPR?
- No. GDPR Article 7(3) says the right to withdraw consent at any time does not affect the lawfulness of processing based on consent before its withdrawal. It does not itself prescribe how already published copies must be removed. This is not legal advice, so ask your data protection officer how to handle them.
- Can we keep a photo in our archive after consent is withdrawn?
- In Beeldbank.nl, once a person is set to "geen toestemming", the images in which that person is recognisable are no longer used. Whether you may keep a stored copy for another purpose is a question for your own privacy policy and your data protection officer. Agree it with the parent or student and write it down.
