Images as Personal data

One of the less obvious consequences of the Ryneš decision which I discussed in a recent post is what it says about the nature of images. At paragraphs 21-22 of the judgement:

The term ‘personal data’ …  covers, according to the definition under Article 2(a) of Directive 95/46, ‘any information relating to an identified or identifiable natural person’, an identifiable person being ‘one who can be identified, directly or indirectly, in particular by reference … to one or more factors specific to his physical … identity’. Accordingly, the image of a person recorded by a camera constitutes personal data within the meaning of Article 2(a) of Directive 95/46 inasmuch as it makes it possible to identify the person concerned.

Clearly and unequivocally the court considers an identifiable image is personal data.  No discussion of the purpose of processing or the potential impact on the subject. No consideration as to whether the person taking or holding the image  is using it to learn something about the individual.

Experienced data protection professionals will no doubt be familiar with the ICO guidance on determining “what is personal data” : see

The discussion by and conclusions of the ICO on pages 15-16 of this guidance, about the same photographs being personal data in the hands of one person, but not in the hands of another, based on purpose and impact  are clearly, following  Ryneš, now unsupportable*. Just as it is now pretty clear that (given context sufficient to identify) a name is personal data (Edem v ICO & FSA [2014] EWCA Civ 92),  so now a photograph, of sufficient quality to identify IS personal data. Of course the taking, holding and use of photographs may be permitted or exempt from restrictions for many reasons but it must now be regarded as personal data even in those cases where the ICO guidance says it is not.

* To be fair if you follow the logic of the guidance the ICO conclusions in the examples were always a bit suspect. They come under Q5: – “Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual? “. In those example photograph cases where the ICO considered the answer to this question was no, the logic of the guidance was that you then ask questions 6, 7 and 8 and a yes answer to any of those, which is likely in the case of photographs (I do not intend here to discuss Durant v FSA) always indicated “personal data” in contradiction of the purpose based  conclusion under Q5.


This entry was posted in GDPR. Bookmark the permalink.

Leave a Reply