I don't think the argument was that it was not in line with GDPR. The argument is that GDPR is wrong itself in not allowing people to consent to anything which

I don't think the argument was that it was not in line with GDPR. The argument is that GDPR is wrong itself in not allowing people to consent to anything which goes beyond "minimal" data collection for the purpose needed, because whether it is "minimal" is, in some sense, a value judgment as to how much convenience and innovation matter. It seems to me that the principle should be personal "ownership" of personal data - and "ownership" of data should imply the owners have the right to alienate that data as the owner sees fit, with the right safeguards to ensure this isn't coerced or a result of fraud. On the other hand, this type of scenario doesn't feel much like the consent given was really voluntary - (1) because noone wants to be the one person who stopped the school from doing something which everyone else was on board with and (2) because it involved adults consenting on behalf of children for something which the children may not be happy about in future when they are adults and it's too late.