General Data Protection Regulation
The face and body are the most basic and most visible elements of our identity. As such, they fall within the definition of personally identifiable information contained in the GDPR (“General Data Protection Regulation”).
According to Art. 4 GDPR ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Personal data, in this case biometric data, is the image (face, body). The image is a legally protected good, as are vehicle license plates, house numbers, and anything by which a person can be identified.
Where an image or video is used or published for commercial purposes, the Regulation requires the data processor (e.g. a company, a road authority, a private person, anyone who comes into possession of such material and intends to process it – share or store it) to request consent from the data subject, i.e. the person whose image appears in the image or video. The consent expresses the voluntary authorization (in a written form) to process the requested data. Unfortunately, in the case of large image data sets, obtaining consent from each person in the data set will be time-consuming and costly due to the hundreds of thousands or even millions of people in the data set. This is when anonymization occurs, making the data subject no longer identifiable and their interests protected.
Practical example
In practice, if, for example, during lane photo-registration, i.e. during the collection of data as part of a road diagnostic campaign, the measurement vehicle has captured an image of a person, this should be treated as sensitive data by which a person can be identified. This data needs to be anonymized. Here, the obligation to anonymize falls on the road manager who organizes the diagnostic campaign and becomes the controller of the personal data. Since he is unable to obtain consent for processing from all individuals, random passersby, drivers, he should anonymize the photos to safeguard the private interests of the individuals visible in the material.
According to Recital 26 (GDPR) Not Applicable to Anonymous Data – anonymized data is no longer covered by the Regulation because it is no longer considered “personal data” as a result of the anonymization process applied:
“The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”