3 ms·
All I know is that my company stores image data and we don' do any face recognition but the lawyers say that to comply we need to start removing faces.
by s17n 9y ago
All I know is that my company stores image data and we don' do any face recognition but the lawyers say that to comply we need to start removing faces.
- marcus_holmes 9y agothat's interesting. Do they say why?
- s17n 9y agoBecause faces are personal information under the gdpr.
- AstralStorm 9y agoWhy? You do not know which user uploaded which picture? Accidental uploads of private data by the user are perfectly fine in terms of GDPR but you must allow for these to be removed on request. If you automatically scrub them it is good, but you do not really have to do that. Telling the user how any pictures will be used and how to get rid of them is enough.
- s17n 9y agoWhich user uploaded which picture is irrelevant - whoever's face is in the picture has rights under gdpr.
- marcus_holmes 9y agoI'm not a lawyer, but surely their face must be identified to be covered? A random face in a crowd is not identification of a person... That's like screening all your binary executables for accidental inclusion of someone's name in ASCII amongst the bytes.