1

I did a Google takeout of Google Photos and was able to download all stored images including some meta data, but not the classification data Google is most likely doing, because I can search for persons and objects in the Photos app.

So my question is:

When a company is requested to provide the personal data to the user, does this also include the derived data?

3

This issue touches upon two distinct GDPR rights:

  • Art 15 right to access: you have a right to receive a copy of all personal data concerning you that are undergoing processing (including storage). Access may only be denied where this would “adversely affect the rights and freedoms of others.”

  • Art 20 right to data portability: if processing is being carried out by automated means, and processing is based on certain legal bases (consent or contract, but not legitimate interest), then you have a right to receive a copy of your personal data in a machine-readable format, for personal data that you have provided to the data controller.

Whereas the right to access is fairly straightforward, the right to data portability applies under much more narrow conditions. Basically, it's a right that you can download any data that you've uploaded so that you can move to a different service.

Google Takeout is primarily concerned with your right to data portability, and provides your data in a machine-readable format. Any photos that you've uploaded to Google Photos, you'll be able to download. Thus, it could be technically compliant to exclude information that they've inferred about your personal data, such as image-recognition results.

Such results would still be personal data under the GDPR definition of the consent, and would be covered by your right to access. Google might argue that you already have access to this data through the web interface. In my opinion the GDPR clearly requires the data controller to provide a “copy”, i.e. the data in some durable form – not merely access through a web interface.

Whereas your question is specifically about Google, the same issue applies to other services as well. E.g. Ruben Verborgh has an interesting blog series on trying to get access to all their data from Facebook, though unsuccessful so far. Similar to your scenario, Facebook offers a download for personal data but does not include all personal data in this download. In one of the documents provided by Facebook in the course of the exchange, they note that they allow access to photo tags through the web interface, but do not include this in downloaded data – without providing further justification.

2
  • the reason might be technical: the photos are a database A, each has an ID as a name. Tags are a separate database B, each tag has its own ID. Then there is Database C, It contains 3 columns: 1st is the id of the match, the 2nd is the Photo ID, 3rd is the Tag-ID. The photo never actually had the tags on it, it is associated with a separate file. – Trish Dec 24 '20 at 11:40
  • @Trish I don't think the technical architecture would have a material impact on compliance obligations. The tags clearly relate to an identifiable person, and thus are personal data as defined by the GDPR. Google clearly has the ability to join across such database tables, and would easily be able to include the tags in a response to a data subject access request. – amon Dec 24 '20 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.