Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that the only other information contained is the file name(s) - such as
00001.jpg. How does GDPR affect the storage, processing, and sharing of such data?
For the sake of argument and to gain clarification of position, I would like to leave aside the provisions within GDPR that provide for processing data as scientific research. I am also working under the assumption that there is no other meta-data, such as a spreadsheet that links image filenames to the person depicted.
GDPR makes clear (Recital 26) that anonymous data is not covered by the regulations:
“… The principles of data protection should [therefore] not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”
Data protection considerations would be significantly reduced if these datasets were considered out of scope of GDPR. Is it possible, however, for a face image in isolation to be considered truly anonymised? It would always be feasible to link it to a real person, because most people are capable of recognising faces. With the image, and the person standing in a crowd, it is likely that the average viewer could identify the depicted person.