7

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that the only other information contained is the file name(s) - such as 00001.jpg. How does GDPR affect the storage, processing, and sharing of such data?

For the sake of argument and to gain clarification of position, I would like to leave aside the provisions within GDPR that provide for processing data as scientific research. I am also working under the assumption that there is no other meta-data, such as a spreadsheet that links image filenames to the person depicted.

GDPR makes clear (Recital 26) that anonymous data is not covered by the regulations:

“… The principles of data protection should [therefore] not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”

Data protection considerations would be significantly reduced if these datasets were considered out of scope of GDPR. Is it possible, however, for a face image in isolation to be considered truly anonymised? It would always be feasible to link it to a real person, because most people are capable of recognising faces. With the image, and the person standing in a crowd, it is likely that the average viewer could identify the depicted person.

Improve this question
2
  • Where is your research based? If outside the EU, it would be sufficient to simply work on faces of people living outside the EU to ignore GDPR.
    – Greendrake
    Commented May 17, 2018 at 8:10
  • That is true. I'm primarily interested in how GDPR will affect researchers based in and using data from within the EU
    – 4Oh4
    Commented May 17, 2018 at 14:21

4 Answers 4

Reset to default
5

Your data is not anonymous since from the picture of the face the individual can be identified.

It would be anonymous, if the face was blurred and other possible identifiable information was removed. Of course, that would defeat your purpose. Please note that, in any case, Anonymization Techniques are, themselves, a type of personal data processing that requires a legal ground, and achieving real anonymization is not a trivial matter (see Article 29 Working Party's opinion 0829/14/EN WP216 on the subject).

1.

The face of a person includes biometric information, which is defined in article 4 (14) among other types of personal information regulated by the GDPR as: "personal data resulting from specific technical processing relating to the physical, physio­logical or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data".

A facial recognition software's purpose is exactly to perform a specific technical processing based on the facial features of the persons, to achieve a unique identification of a person based on these biometric features.

Article 9 of the GDPR includes biometric data among the types of prohibited processing, unless one of the exceptions in § 2 applies.

There are 10 types of exceptions among which: consent of the person, employment context, personal data made public by the person, scientific or historical research,... (each exception having its own conditions).

You should check that you comply with one of these exceptions stated in article 9 § 2, if your application is about using facial images for unique identification of a person based on these biometric features.

2.

In turn, if your processing is not about unique identification of a person based on these biometric features, but only about emotions recognition (which you briefly mentioned at the beginning of your post), it could be considered as not falling under the requirements of Article 9.

That would still be a processing of personal information, but it would fall under the normal article 6 requirements.

Improve this answer
7
  • The Article 29 Working Party's Opinion is the most authoritative documentation I've seen to date. I would suggest that Article 4 does not mean that all facial photographs are biometric data, by default, and that it comes down to how they are processed. GDPR Recital 51 addresses this: 'The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.'
    – 4Oh4
    Commented May 24, 2018 at 11:52
  • @4Oh4 the determination that a photograph is not biometric data does not constitute a determination that it isn't personal data.
    – phoog
    Commented May 24, 2018 at 13:09
  • @4Oh4, thank you for spotting the broken link to WP29's Opinion (I corrected it to the actual europa.eu source which I intended to post). I agree that it could be argued that not all "facial photographs" stored by, say, a photobooth, are "biometric data". GDPR talks about "facial images" resulting from a technical process. But rather that facial photographs contain biometric information (which is sensitive personal information or "special categories" of personal data as the GDPR says), which can be extracted and used with facial recognition software and represented as a "facial image".
    – Tardis
    Commented May 24, 2018 at 13:45
  • Is there anything in the GDPR that suggests that the identification process implied by "identifiable" must be algorithmic? If a person can look at some data (e.g., a photograph) and identify another person from it, then that data is personal data under the regulation, at least until a court holds otherwise.
    – phoog
    Commented May 24, 2018 at 14:27
  • @phoog, indeed, a photograph of a person is a personal information in my opinion under the GDPR, and earlier EU Directive and its collection and processing require a legal ground based on article 6 of GDPR. The fact that a facial photograph can be used to extract biometric data with appropriate technical processes, results in the "facial image" falling in a "special category" of information (biometric information), which collection and processing is, in principle forbidden, unless you fall under one of the exceptions foreseen by GDPR in article 9 § 2...
    – Tardis
    Commented May 24, 2018 at 14:46
3
+25

Something is personal data, if there is an organisation which can link that data to a natural person, even if you cannot simply ask those organisations to do so for you. For example, an IP-Address is personal data, because an ISP can match an IP address with a household.

As far as I know, both google and facebook are able to identify a picture, based on other pictures of the same person. So that makes a picture of a face personal data, even if it is completely anonymised.

Because a face reveals racial and ethnic origin, article 9 GDPR applies;

  1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

But there are exceptions;

  1. Paragraph 1 shall not apply if one of the following applies:

    (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

    [...]

Of course this consent can not be stored together with the image, as it would deanonymize it, which would defeat it's purpose.

Maybe it would be sufficient if a trusted third party, like the photographer could confirm the data subject has given consent for certain usage. You have to make sure the image is not used in any other way, as the consent must be very specific.

Otherwise you have to look at the other exceptions in Article 9.2. If nothing applies, it is not possible.

Improve this answer
6
  • 1
    Good points. Regarding Article 9 though, it relates to 'Processing of special categories of personal data', and Recital 51 is quite clear that 'The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.'
    – 4Oh4
    Commented May 23, 2018 at 16:18
  • "processing of special categories of personal data" is distinct from "processing personal data."
    – phoog
    Commented May 24, 2018 at 13:02
  • Why must the entity capable of identifying a person from some data be an organization? Is that contained anywhere in the regulation? If someone's mother can identify them in a photograph, doesn't that make the person "identifiable" from the photograph?
    – phoog
    Commented May 24, 2018 at 13:13
  • @phoog If someone's mother can identify them in a photograph, someone else first need to find that mother. When I mention an organistion, I mean some known central place to contact, possibly using a court order.
    – wimh
    Commented May 24, 2018 at 14:37
  • @4Oh4 Reading through Recital 51, it looks you are right.
    – wimh
    Commented May 24, 2018 at 14:38
1

Your face is pretty much the fundamental identifying thing about a person. Not only can people unconsciously identify faces they know, algorithms are getting increasingly better and if tied to a database, know way more people than any individual does.

While we don’t yet know how the courts will deal with this, I think it is naive to believe photos of individuals will not be captured by GDPR.

Improve this answer
0

While a court could narrow the application of "identifiable," a prudent person would, at this early stage, interpret the term broadly. "Anonymous information" is

information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Unless the image is altered so the person it depicts is no longer identifiable, the image is not "anonymous information."

Another answer asserts that "identifiable" implies "by an organization," but I see no basis for that in the regulation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .