Aren't they only required to delete the data on request? They don't have to actually provide it back to you

No, you can request your personal data as a part of GDPR (and most other privacy laws). That's why things like Google Takeout still exist.

They have to provide the data on request. I also think they aren’t allowed to delete any data they have when you request it before providing it (although you can of course also request deletion).

https://gdpr-info.eu/art-15-gdpr/

IANAL.

Article 15 says you have the right to request the data and they must provide it to you.

Article 20 says you have the right to get your photos back in a machine readable format.

Sadly, this only applies to those in the EU. Americans can keep taking it, which makes sense as it's an American company that's giving it. Sigh.

Minnesota and some other states have similar laws that basically mirror GDPR. States have forms you can get that you would submit to the company. I’ve done it for my Matterport data after they started making you pay to unarchive content (originally free)

Honestly I would just try doing a GDPR request and see what happens. They first have to find out if you’re from the EU, and they probably will err on the side of caution and just fulfill it.

> They first have to find out if you’re from the EU

Technically, you don't have to be from the EU. You just need to be in the EU (which includes Americans who are just vacationing in the EU).

Actually when reading up more on it, it looks like you don’t have to be in the EU at all.

If I understand it correctly, the GDPR applies to any company that does business in the EU and it doesn’t even matter where the data subject is located or which country they are a citizen in. So even if you’re from the US, you should be able to make a valid GDPR request.

Could also say you’re a California resident and get your data too. They’ll probably just ignore or say no if they’re being that shady.

Well... If I was smarter, I'd have definitely done that!

Are photos considered PII?

Not in general, but depending on what’s on them maybe. A profile picture showing my face definitely is.

But I’m also not sure that they only have to give you PII.

PII is a US-specific concept that has little relevance to the GDPR. So I wouldn’t say for sure that they have to give those photos to you but it wouldn’t be as simple as “not PII”.

Ummmm

The GDPR also covers data portability, so preventing your data (not just personal data) from being held hostage.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

GDPR covers more than just PII.