That’s not how it works at all lmao. I recommend you read article 4 point 1 of GDPR (and point 2 for good measure). It really is enlightening!

That is remarkably not the case in the European Union. There is no exception to GDPR with respect to public places. The only legal basis for using public personal data without consent is to do it under legitimate interest basis (GDPR article 6, very specific exceptions exist). In that case, you must use the public data in a way that the data subject would reasonably expect (GDPR recital 47). Taking a picture of somebody in a public place and sharing it without them knowing is definitely unlawful, assuming free consent was not given.

You can always retract consent and request deletion of personal data after the facts, no justification needed (GDPR article 17).

You can quote GDPR directly, I do it all the time and the French regulator (CNIL) does it too. The member state’s backing law is an implementation detail.

I recommend asking informally first. If that does not work, you can remind them of their obligations under GDPR. If you have not given consent for this, you can mention their processing is unlawful under article 6 of GDPR, which specifies a list of valid basis for the processing of personal data (typically getting direct consent). You will have to check you did not previously give consent to this processing, however. In any case, if you did, you are allowed to retract it at no conditions.

My experience of fighting companies on GDPR grounds is that they often come up with bullshit about “legitimate interest” (article 6 point f) to pretend they are using a legitimate basis. I don’t expect it would be necessary but if you want to have a stronger legal claim, you can instead claim that their processing is unlawful under article 9, as a photograph is personal data revealing ethnic/racial origin. One caveat: if you gave them consent for this, this does not apply.

In any case, even if you have given previous consent, you can withdraw the consent and request that your personal data is erased under article 17 point 1b. Because they made it public, they will have to also remove it from public places to the extent of what is possible (article 17 point 2). This would typically mean that they have to remove it from Instagram also.