Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I'm triyng to understand whether, under European GDPR, an image of a person's face is a "Special Category Data".
From this image I could determine person's:
Is handling a person's image considered as handling "Special Category Data"?
Is handling a person's image considered as handling "Special Category Data"?
By default, no.
But, if this person is already identified (you have some additional personal data of this person) or is easily identifiable (a celebrity, known politician or otherwise known person whose identity can be revealed by using a reverse image search, or maybe there is something unique about him or her), then it could be.
It depends a lot on what kind of photo/image is being processed. For example, Facebook avatars can be images of almost anything. You could deduce a lot of information from them - political opinions, health status, maybe even sexual orientation. There might be a lot of wrong guesses though (people often make jokes). This is different when you store ID card photos - those might be serious photos in uniforms, no jokes, no political messages, just blank stare to the camera. You could try guessing from skin color, but there could be high probability of error. Not all white people are Europeans or are descendant from Europeans. Not all black people are from Africa. It's as prone to error as guessing from name or e-mail address. You can take guesses and say that "Takashi Nakamura" is Japanese. And maybe he is! But that doesn't make us see special category of personal data in names.
(Also, I asked a high-profile lawyer who specializes in the protection of personal data and he told me: "nobody really knows".)
