>Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. The GDPR doesn't c

>Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. The GDPR doesn't care about 'private' data (for the most part) as it only cares about personal data, and faces absolutely are considered personal data under article 4 point 14. Faces are even in a special category of data which you are prohibited from processing at all unless some conditions are met, although article 9 point 2e allows processing such data if they have been 'manifestly made public'. The GDPR doesn't define what 'manifestly made public' means but the Scottish Parliament[0] suggests that it could mean images purposely uploaded to social media and made public, but note that just because you are not prohibited from processing such images does not mean you have a lawful basis for processing that data in the first place. >It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'. >Implementation detail. This can be totally avoided. Tool can accept picture and return the result. This is an implementation detail that I had not considered. The original tool and article talks about crawling both porn sites as well as social media and both are fraught with legal issues, not every video or image on porn sites is going to be legal in the first place (revenge porn, stolen images) never mind the copyright issues involved, and crawling social media for this information is simply not acceptable under the GDPR. >Tool can also create opt out mechanism Such a tool would almost certainly need to be opt in from the data subject, article 6 makes this clear, you need specific consent from the data subject or some other conditionals which aren't applicable here. Best case scenario if you want to operate such a tool in Europe is that you argue (in court, mind) that you have a legitimate interest to run such a tool which does not override the fundamental rights and freedoms of the data subject, which does not seem like it would go in your favour at all. [0] Page 6: https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motions_Guidance_FINAL.pdf https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motio...