This law has nothing to do with signing away the rights of your image to be used for publicity, though. GDPR does not come into play at all in the scenario with your friend’s daughter; the school is likely abusing laws in their request and should be investigated, but those laws aren’t related to GDPR and the existence of GDPR does not somehow cause the daughter’s position to be weaker here.