2

I'm triyng to understand whether, under European GDPR, an image of a person's face is a "Special Category Data".

From this image I could determine person's:

  • ethnic origin (for example: from the colour of the skin)
  • religion (for example: the person wears Sikh turban)

Is handling a person's image considered as handling "Special Category Data"?

|improve this question
  • This question has been downvoted, to improve my future questions it would bee very useful a motivation. Thanks! – nulll Jul 1 '18 at 7:38
  • 2
    I think the downvote may have been due to the poor English usage in the question, as well as the presence of "Thanks!" at the end, which is not how questions are supposed to be written on the site. I edited the questions to reflect this. Also, your question may have an answer here: law.stackexchange.com/questions/28372/… – isaacg Jul 1 '18 at 17:47
1

Is handling a person's image considered as handling "Special Category Data"?

By default, no.

But, if this person is already identified (you have some additional personal data of this person) or is easily identifiable (a celebrity, known politician or otherwise known person whose identity can be revealed by using a reverse image search, or maybe there is something unique about him or her), then it could be.

It depends a lot on what kind of photo/image is being processed. For example, Facebook avatars can be images of almost anything. You could deduce a lot of information from them - political opinions, health status, maybe even sexual orientation. There might be a lot of wrong guesses though (people often make jokes). This is different when you store ID card photos - those might be serious photos in uniforms, no jokes, no political messages, just blank stare to the camera. You could try guessing from skin color, but there could be high probability of error. Not all white people are Europeans or are descendant from Europeans. Not all black people are from Africa. It's as prone to error as guessing from name or e-mail address. You can take guesses and say that "Takashi Nakamura" is Japanese. And maybe he is! But that doesn't make us see special category of personal data in names.

(Also, I asked a high-profile lawyer who specializes in the protection of personal data and he told me: "nobody really knows".)

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.