Do Images Contain Personal Information Under the CCPA and GDPR?

The answer is, it depends. Images and video recordings are valuable digital assets, particularly in the era of generative AI. But, if images and video recordings depict identifiable people, they may contain "personal data" (or personal information), which could trigger the California Consumer Protection Act (CCPA) and the General Data Protection Regulation (GDPR).

Both the CCPA and the GDPR are laws that seek to comprehensively regulate privacy. As a threshold matter, each law applies to specific types of processing of data and specific types of business. The GDPR applies to (1) the "processing of personal data in the context of the activities of an establishment of a controller or a processor in the [European] Union," and (2) "processing of personal data of data subjects who are in the [European] Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services . . . to such data subjects in the Union; or (b) the monitoring of their behaviour . . . ." (GDPR Art. 3.) The CCPA applies to for-profit businesses in California meeting any one of the following: (i) gross annual revenue over $25 million; (ii) buying, selling, or sharing the personal information of at least 100,000 California residents; or (iii) derive 50% or more of their annual revenue from selling California residents' personal information. CCPA section 1798.140(d) (but see the updated threshold here: https://cppa.ca.gov/regulations/cpi_adjustment.html).

Assuming GDPR or CCPA apply to your business, both laws define personal information broadly. Under section 1798.140(v)(1) (CCPA), "personal information" is defined as

information that identifies, relates to, describes, is reasonably being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer . . . . Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer: . . . (H) Audio . . . visual . . . or similar information.

Under Article 4(1) of the GDPR, "personal data" is defined as

any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person . . . .

Under both laws, images and video recordings can contain personal information (or personal data, in the case of the GDPR). Under the CCPA, an image or video recording of a natural person certainly contains information that "identifies, relates to . . . and could reasonably be linked" with a particular consumer (which is defined under subsection (i) as a "natural person who is a California resident"). For instance, an image could contain facial features (e.g., facial structure, eye color, and distinctive marks), distinctive marks (e.g., tattoos), and facial geometry. The same is true with the GDPR; an image or video recording of a natural person could contain information "relating to an . . . identifiable natural person . . . ."

The above raises important privacy considerations for those companies who own or have license rights to digital assets (i.e., images and video recordings). Companies must diligently navigate these privacy concerns to ensure they can exploit their digital assets while minimizing privacy risks.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship between you and SARG Law. You should consult a qualified attorney for advice regarding your individual situation.