It is in the news that artificial intelligence (AI) has been applied to aerial photography to identify homeowners who have made unauthorised additions of swimming pools to their properties in France. This has allowed them to be taxed.

The UK ICO defines personal data as:

  • Personal data only includes information relating to natural persons who:
    • can be identified or who are identifiable, directly from the information in question; or
    • who can be indirectly identified from that information in combination with other information.

It would seem that this technique has demonstrated that individuals are identifiable from this sort of aerial photography. Does this make the various forms of satellite imaging available online subject to the GDPR?

  • 1
    Why do you think that information about ones property is information about the person itself? Who owns a house and how it looks is registered in central databases that are public. Requests for new constructions are public, too.
    – PMF
    Aug 30, 2022 at 10:09
  • 1
    @PMF Whether information is public has no bearing on whether that information is personal data in the sense of the GDPR. At most, the public availability of the information could weigh in the data controller's favour during a legitimate interest balancing test.
    – amon
    Aug 30, 2022 at 11:09
  • @PMF Per the ICO's guidance (which paraphrases Article 4(1) of the UK GDPR), information doesn't need to be "about the person itself" to be personal data. It merely needs to be information which relates to a person who is identified or identifiable either directly or indirectly. Homes are (usually) owned by a person, that person can be identified from the address of the home, and the fact of the ownership and the existence of a swimming pool is information which relates to that person.
    – JBentley
    Aug 30, 2022 at 11:15

1 Answer 1


Personal data is any information relating to an identifiable person, even if that person is only identifiable with the help of additional data and/or third parties.

Making inferences about a particular person, for example whether that person might have performed unauthorized construction, sounds very much like processing of personal data to me. In this scenario, the information is used to verify the tax assessment for a particular person, so the information clearly relates to a data subject.

The owner for a piece of land is certainly identifiable with the help of the land registry, if one exists in the country. Similar registries might also exist with tax authorities or a postal service. Here, it is the tax authority itself doing the processing, so they probably already have tax records about the owners at the address.

But just because it's processing of personal data doesn't mean that it is illegal.

  • Satellite data and aerial photography providers can probably rely on a legitimate interest to collect, sell, or otherwise publish their data. Homeowners can reasonably expect that their property will be included in low-res aerial photography. It might not be necessary to notify the data subjects if an exception in Art 14(5) applies.
  • A public authority using aerial photography to find building code violations or to levy correct taxes may be able to base this processing activity on authorization via some law. If the public authority would have the right to inspect the buildings, then it might be possible to argue that the public authority can use aerial photography to decide which inspections/audits to prioritize. Of course, decisions producing significant legal effects must not be based on “AI” alone, due to the Art 22 GDPR right to not be subject to unchecked automated decision making (unless specifically authorized by a suitable law).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .