Identity photographs under GDPR

Question

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018?

It seems to me they would almost certainly be, even if not processed for biometrics currently because they are likely to cover at least race, ethnic origin and frequently also religion. Health may also be covered by such photographs, if for example an individual has visual signs of health issues in/around their head.

I believe the above points should be sufficient to conclude that identity photographs almost always count as special category data, but given that a well taken identity photograph could trivially be used to extract biometric information I can't really see how that case also wouldn't apply. This seems to cover even the retention of printed copies of photographs.

Is my reasoning here correct? Is there anything concrete to support this interpretation? Given the substantially raised barrier to using such data how can an organisation legally justify their use of ID photographs on membership cards (and a corresponding record retained by them)?

Answer 1

Your reasoning makes sense to me. Photographs of people by themselves do not constitute a special category of personal data (see quote) but this type of structured database, with specific fields for each of these categories (albeit in a slightly inconvenient format, namely images), seems to fit the definition very well.

From Recital 51:

(3) The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.

If you can't find a legal basis for processing the data in Art. 9(2), you can think about technical measures to remove the special categories from your dataset (maybe you can redact those fields from the image and still be able to achieve your goals). Note that you may still be processing the data in other ways.

If you are or suspect you are processing special categories of personal data, you should conduct a data protection impact assessment. You will definitely benefit from the exercise because it forces you to go through all the categories of data that you have, how it's processed, if the processing is actually necessary, the legal bases, and what technical and organisational measures you have implemented (or are going to implement) to reduce the risk.