Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a placeholder or thumbnail for the actual image. Suppose I store the blurhash for each profile picture in my web service's database.
Then, if a user requests via GDPR full deletion of their data from my web service, would I be required to delete also their profile picture blurhash? This might overlap with copyright law, and I would like to know if a blurhash is a "derivative work" and thus is my (the company running the web service) creation, not the user's creation.
Here is an example of a blurhash.
The original image (a public domain picture from Unsplash):
Here is the blurhash code:
And here is the blurhash image: