I'm triyng to understand whether, under European GDPR, an image of a person's face is a "Special Category Data".
From this image I could determine person's:
Is handling a person's image considered as handling "Special Category Data"?
Whether some data falls under “special categories” of data can depend on how this data is processed. The same image of a face could be just a bunch of bytes when processed by a storage service (totally OK) or could be used to reveal sensitive information.
For example, Facebook used to apply facial recognition to automatically tag people in pictures. Facial recognition involves processing of biometric data, which can be extracted from photos. The problem isn't that Facebook had these photos, but that Facebook processed these pictures as special categories of data. Per Art 9 GDPR, processing of special categories of data is forbidden, unless one of the exceptions like explicit consent applies.
The context of a picture could also cause a photo to fall under “special categories”. In Guidelines 03/2019, the EDPB considers an example where a video shows people participating in a strike. If those people are identifiable, this video would represent information regarding political opinions or union membership.
The relevant legal sources are Art 9(1) GDPR and Recital 51 GDPR.
In Art 9(1) GDPR, the concept of special categories of personal data is introduced:
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
Formatted as a list:
- Processing of personal data revealing
- racial or ethnic origin,
- political opinions,
- religious or philosophical beliefs,
- or trade union membership,
- and the processing of
- genetic data,
- biometric data for the purpose of uniquely identifying a natural person,
- data concerning health
- or data concerning a natural person’s sex life or sexual orientation
- shall be prohibited.
These categories are split into two groups: one group for data that reveals certain information, another group for kinds of data (e.g. health data). Biometric data is unique in that its processing is only forbidden for the purpose of identification. The other categories are not limited to a purpose and their processing is forbidden in general.
Recital 51 GDPR explains some background on this. It explicitly discusses the role of photographs:
The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.
This is reassuring for you: photographs aren't generally “special categories” of data. But the rationale only discusses biometrics, whereas your question is more broadly about sensitive information that can be revealed through the photo. It is unclear to me what that means. Potentially, a photo doesn't “reveal” anything on its own, so it would only be the result of further processing activities that could be special categories of data. I believe that the purpose of processing would be the more relevant factor.
The UK ICO also writes on this matter:
Therefore, if you have inferred or guessed details about someone which fall into one of the above categories, this data may count as special category data. It depends on how certain that inference is, and whether you are deliberately drawing that inference.
This seems to suggest that an inference made from non-special data could fall under special categories of data.
What Grzegorz Adam Kowalski says in another answer isn't wrong, but is misleading. For the question whether a picture falls under sensitive categories of personal data, it is not that important whether the subject (such as a celebrity) is directly identifiable from that picture. The GDPR's actual definition of personal data is wider than that: personal data is any information relating to a directly or indirectly identifiable person. To understand whether someone is identifiable, account must be taken of all the means reasonably likely to be used by the data controller or others (compare Recital 26). Once we have determined that a photo is personal data (and a photo of a person's face will almost always be personal data), we can consider in a next step whether it would also fall under “special categories” of data.
Is handling a person's image considered as handling "Special Category Data"?
By default, no.
But, if this person is already identified (you have some additional personal data of this person) or is easily identifiable (a celebrity, known politician or otherwise known person whose identity can be revealed by using a reverse image search, or maybe there is something unique about him or her), then it could be.
It depends a lot on what kind of photo/image is being processed. For example, Facebook avatars can be images of almost anything. You could deduce a lot of information from them - political opinions, health status, maybe even sexual orientation. There might be a lot of wrong guesses though (people often make jokes). This is different when you store ID card photos - those might be serious photos in uniforms, no jokes, no political messages, just blank stare to the camera. You could try guessing from skin color, but there could be high probability of error. Not all white people are Europeans or are descendant from Europeans. Not all black people are from Africa. It's as prone to error as guessing from name or e-mail address. You can take guesses and say that "Takashi Nakamura" is Japanese. And maybe he is! But that doesn't make us see special category of personal data in names.
(Also, I asked a high-profile lawyer who specializes in the protection of personal data and he told me: "nobody really knows".)
