You can quote GDPR directly, I do it all the time and the French regulator (CNIL) does it too. The member state’s backing law is an implementation detail.
I recommend asking informally first. If that does not work, you can remind them of their obligations under GDPR. You can mention article 6 of GDPR, which specifies a list of valid basis for the processing of personal data (typically getting direct consent). You will have to check you did not previously give consent to this processing, however. In any case, if you did, you are allowed to retract it at no conditions.
My experience of fighting companies on GDPR grounds is that they often come up with bullshit about “legitimate interest” (article 6 point f) to pretend they are using a legitimate basis. I don’t expect it would be necessary but if you want to have a stronger legal claim, you can instead claim that their processing is unlawful under article 9, as a photograph is personal data revealing ethnic/racial origin. One caveat: if you gave them consent for this, this does not apply.
In any case, even if you have given previous consent, you can request that your personal data is erased under article 17 point 1b. Because they made it public, they will have to also remove it from public places to the extent of what is possible (article 17 point 2). This would typically mean that they have to remove it from Instagram also.