St Josephs School
I honestly don't know if this website comes under GDPR. I am assuming not. There is no official school organisation behind it and the school no longer exists. Perhaps the best approach would be to make the site members only and just leave the unidentified photos on public display. Members could then give their permission for use of their personal data. Trouble is that by the nature of the site it is intended to share names and stories about other ex school friends. These friends cannot give permission for their data to be shared as nobody knows where they are or even if they are still alive.