5 things you should know about GDPR for images
GDPR regulations impact how organizations can use images of identifiable people, often making workflows more complex. This article covers five essential facts about GDPR for images, helping you stay compliant and protect individual privacy with ease.
#1 Personal data includes images
According to the European Union, there are several categories of personal data. Personal data refers to all information that relates to an identified or identifiable living individual, and also includes pieces of information that can lead to the identification of someone when collected together. This means that assets like images and videos can also fall into this category, and may result in data protection law breaches if not managed correctly.
Today, images are everywhere - on an organization’s website, social media pages, marketing campaigns, and much more, often featuring people. With the rise of advanced technologies like Artificial Intelligence and Cognitive Services, facial recognition and image searches are more efficient than ever, resulting in most visuals containing individuals being classified as personal data.
Learn more: How two of Norway's largest enterprises solved GDPR challenges with images
#4 The term ‘data controller’ encompasses a wide variety of actors
The EU defines a ‘Controller’ as a person, public authority, agency, or other body that either alone or jointly determines the purposes and means of the processing of personal data. This definition is rather broad and may encompass anyone who’s working with the data, including private individuals as well as enterprises. This suggests that people managing personal data can be held personally accountable for GDPR breaches, as seen in a German court case in early 2022.
Over recent years, we’ve witnessed an increased focus on personal privacy that shows no signs of slowing down. Therefore, it’s likely that the German court case is just one of many that apply a broader definition to the term ‘Controller’. This may result in high-level professionals being held accountable for breaches resulting from poor personal judgment or failure to follow internal routines.
Simply having rules for data management is not enough for effective GDPR compliance. Modern organizations should ensure that their processes are easy to follow, as mistakes often happen when procedures are too inefficient.
