4

Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a placeholder or thumbnail for the actual image. Suppose I store the blurhash for each profile picture in my web service's database.

Then, if a user requests via GDPR full deletion of their data from my web service, would I be required to delete also their profile picture blurhash? This might overlap with copyright law, and I would like to know if a blurhash is a "derivative work" and thus is my (the company running the web service) creation, not the user's creation.

Here is an example of a blurhash.

The original image (a public domain picture from Unsplash):

enter image description here

Here is the blurhash code: +GFO+E4n5S~p4n%MRjE101R+-URjt7xu%Laet7ofoeR+xuD*R*n%RQt6n%kCs.tQM{of

And here is the blurhash image:

enter image description here

Improve this question
5
  • 2
    The copyright question is q separate question and should be asked as such, but you will be interested to learn that (speaking generally) the copyright in a derivative work belongs partly to the creator of the original work and partly to the creator of the derivative work.
    – phoog
    Aug 6, 2022 at 15:34
  • 2
    Note that if the user requests deletion, that doesn't necessarily mean you have to delete all their data; there may be justifications (e.g. tax records, accounting, contract evidence, law enforcement requests) for keeping some of it.
    – Paul Johnson
    Aug 6, 2022 at 15:52
  • 2
    @phoog This is correct in general, but in this case the blurhash is created by an automatic process. The web company doesn't get any rights in it because it hasn't done anything creative.
    – Paul Johnson
    Aug 6, 2022 at 15:54
  • 1
    @PaulJohnson good point, thanks.
    – phoog
    Aug 6, 2022 at 17:07
  • Transformations like this do not stop the data being personally identifiable, since anyone with the original data can perform the same transformation and compare the results. The anonymised data exception for GDPR only applies when de-anonymisation is not trivial.
    – user
    Aug 7, 2022 at 17:07

2 Answers 2

Reset to default
17

From the GDPR's definitions:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

This blurred image would be "information relating to an identified ... natural person (‘data subject’)." It does not matter whether the person can be identified using the information in question. Therefore, the answer to your question

Under GDPR, does blurhash of a profile picture count as personal data

is yes.

Improve this answer
6
  • 8
    This doesn't sound realistic. If I say "A person's personal photo is a JPEG image with 800x600 resolution", that is certainly relating to an identified, natural person... Would that count as GDPR data? What about "the photo is 425091 bytes"? What about reducing the photo's resolution and pixel depth so much that it can be described as a single pixel in three bytes in RGB as "255, 255, 255"? Is that personal data?
    – forest
    Aug 7, 2022 at 0:17
  • 5
    For a real-world example where this kind of a hash allowed for de-anonymization, see: politics.stackexchange.com/questions/41160/…. So +1, this data should be deleted under GDPR.
    – JonathanReez
    Aug 7, 2022 at 4:34
  • 2
    @forest whether it's realistic isn't in question, only whether it meets the definition. Whether the datum is "an image of this person yields this hash" or "the number of pets this person owns is this number," it meets the definition. But...
    – phoog
    Aug 7, 2022 at 9:13
  • @JonathanReez this answer doesn't address the issue of whether or under what circumstances the data must be deleted. I wrote it somewhat hastily and lost sight of that question as I was looking up the definition of "personal data."
    – phoog
    Aug 7, 2022 at 9:14
  • @phoog So it doesn't have to be possible to identify the person with the data at all? Is it a cut-and-dry case that "the even parity of this JPEG image of a person's face is 1" is GDPR-protected data?
    – forest
    Aug 8, 2022 at 19:04
-3

if a user requests via GDPR full deletion of their data from my web service, would I be required to delete also their profile picture blurhash?

No. In a GDPR inquiry, the blurhash code/image such as the sample you provide would be treated as anonymous information even if they originate from a real person.

Recital 26 of the GDPR clarifies that "[t]he principles of data protection should therefore not apply to [...] personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable". That is the case with the blurhash code and/or blurhash image because it is impossible to identify from them a natural person.

In many contexts, natural persons can be identified by combining unique identifies and information from different sources. See recital 30. However, a [blur]hash code would hardly contribute to identifying a natural person because the code is too volatile. Indeed, any tiny variation in the original image --even in the background-- would lead to a very different hash code.

Improve this answer
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Pat W. ♦
    Aug 8, 2022 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .