AFAIK according to the GDPR, knowing each individual fact is fine. Only the combination is PD. Hence, installing a camera that counts black-haired people, an

AFAIK according to the GDPR, knowing each individual fact is fine. Only the combination is PD. Hence, installing a camera that counts black-haired people, another that counts people entering some location, a third counting people having a BMW is perfectly fine. Merging the 3 recorded tapes to identify a person is not. Giving the 3 tapes to someone else is only OK if you guarantee somehow they wont do the merge.