Re:Google Fights Back
by icebraining on Wednesday May 08, 2019 @07:38PM
(#19864008)
Yes, if the neural net can identify a person, it's covered by the GDPR:
"Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" (Recital 26).
In which case you need a lawful basis for doing such processing (of which consent is just one possibility). Furthermore, that's considered "profiling" and is subject to extra rules if it can have strong impact on the person's life.
On the other hand, if the data is well mixed with other people's, preventing that recognition, then it has been anonymized, and therefore it's not longer subject to the GDPR (Recital 26). But note that you're still subject to it when you're capturing and using personal data to train that model, even if the model itself is anonymized.
"Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" (Recital 26).
In which case you need a lawful basis for doing such processing (of which consent is just one possibility). Furthermore, that's considered "profiling" and is subject to extra rules if it can have strong impact on the person's life.
On the other hand, if the data is well mixed with other people's, preventing that recognition, then it has been anonymized, and therefore it's not longer subject to the GDPR (Recital 26). But note that you're still subject to it when you're capturing and using personal data to train that model, even if the model itself is anonymized.