School shares my child's data without consent — what now?

Schools have stricter regime than other organisations: UAVG Art. 5 (under 16 parental consent), GDPR Art. 9 (pupil health data), AP priority enforcement for child data. What counts as unlawful sharing? School photos on social without parental consent, pupil data shared with EdTech suppliers without DPA, lists with names + addresses to municipality/third parties, photo in yearbook without per-medium consent, child data in cloud without Schrems II TIA. Routes: Step 1: written erasure request to DPO + principal (GDPR Art. 17). Step 2: on no response within 30 days → AP complaint (child data = priority). Step 3: in parallel Education Inspectorate report for education aspect. Step 4: on major harm civil damages claim Art. 82 — child data leaks typically receive €500-€2,500 non-material damages. WBTR impact: school directors personally liable on serious negligence since 2021.