So many people or so many people in the web service tech industry that frequents HN?

To give you an idea, I work at a school. Every member of teaching staff all of admin, site-services and IT have had GDPR training. Getting consent for photos, for school trips, referral to outside agencies is a substantial issue, as is leaving student records on desks, keeping files with PII on encrypted sticks etc.

This is a school.

That's interesting. So now a student can come back and demand you delete their permission slip for a field trip?

Schools collect data under several of the possible lawful bases

https://ico.org.uk/for-organisations/guide-to-the-general-da...

In the case of a permission slip - the school already holds lots of info that the school collects under the 'Public Task or 'Legal Obligation' bases.

The slip then contains additional information that is only collect because the kid is going on a trip, but is necessary for the trip. This would be collected under the Contract basis 'If you want to go on this trip, the following info is necessary'.

If the school also wants to take photos of the child on the trip, for example, then the parent will be asked for consent.

So to answer your question, the parent (assuming the child is under 16) could ask for:

1. The photo consent to be removed - in which case the trip must continue

2. The info pertaining to the school trip to be removed (in which case the kid would no longer be going on the trip)

But they cannot request the core data that the school holds to be removed, unless they take their kid to another school.

Any company that stores any kind of personal data on private citizens. Which means the vast majority of companies.

I work at a telco/ISP and GDPR training (and graded tests) is mandatory for everyone, from customer support to CEO.