Visual Data Sharing with Third Parties - Personal Data Protection and Transatlantic Data Transfers Perspective

Visual data anonymization is the process of altering photos and videos so that individuals and vehicles can no longer be identified, typically through face blurring, license plate blurring, background masking, and metadata removal. Under GDPR and UK GDPR, data that is truly anonymous falls outside the scope of data protection law, provided re-identification is not reasonably likely using all means reasonably likely to be used [1][2].

Why anonymization matters when publishing images and videos

Images and videos often contain personal data, including faces, license plates, uniforms with names, and recognizable locations. If a person can be singled out or identified, the footage is personal data and processing must meet GDPR or UK GDPR requirements. Anonymization allows organisations to publish, share with agencies, or train internal teams while reducing regulatory exposure. However, anonymization must be robust. If a subject can still be identified by context or metadata, the output remains personal data [1][4].

Techniques that commonly support compliance

Face blurring and license plate blurring reduce direct identifiers. Background masking or selective redaction removes secondary cues like distinctive tattoos, building numbers, or workstation screens. Metadata removal strips EXIF and IPTC tags that could reveal device IDs, GPS coordinates, or timestamps that enable linkage. Organisations often combine these methods and test outputs for re-identification risk as a business practice.

Three exceptions where consent to publish an image may not be required

The following scenarios may exist in some jurisdictions and are context-dependent (typically under image rights / personality rights or similar regimes). They do not override data protection obligations where personal data remains identifiable.

1. The person is widely known (a public figure), and the image was taken in connection with their public role.
2. The person appears only as a part of a larger scene, such as a landscape or public event, and is not the main subject.
3. The person was paid to pose (e.g., a model) and the agreed scope of use includes publication; this depends on the contract/terms and applicable local law.

Whether these apply depends on local law, copyright and image rights, and the specific facts. Where doubt remains, organisations often consider anonymization or a different lawful basis to reduce risk.

Workflow for publishing visual content with third parties

1. Define purpose and audience. Clarify whether the visuals will be public, shared with vendors, or used internally.
2. Minimise at capture. Avoid filming close-ups of faces and plates when not needed, and avoid capturing unnecessary sensitive scenes.
3. Detect and blur. Apply face blurring and license plate blurring. Consider background masking for distinctive features that aid re-identification.
4. Remove metadata. Strip EXIF/IPTC and thumbnails. Standardise filenames so they do not encode personal data.
5. Validate quality. Sample frames to check for false negatives and false positives. Adjust thresholds and re-run when needed.
6. Decide deployment. Prefer on-premise software to process footage locally and minimise outbound transfers. This supports security and reduces reliance on cross-border data flows.
7. Document decisions. Record the technique settings, residual risk assessment, and checks performed. This is a common compliance approach for auditability.
8. Share with third parties using least data. Provide anonymized exports. Where original footage must be shared, use encryption, short retention, and contractually limit downstream use.

Check out Gallio PRO for on-premise visual data anonymization aligned with these steps.

GDPR vs UK GDPR for publishing photos and videos

Transatlantic data transfers when sharing visuals

When photos or videos remain personal data after processing, sharing them with a US vendor is a Chapter V transfer under GDPR. Options include: (1) the EU-US Data Privacy Framework for certified US recipients [6], (2) Standard Contractual Clauses with transfer risk assessment and supplementary measures where needed [3], or (3) an adequacy decision where applicable. Under UK GDPR, similar tools apply through adequacy regulations and the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, supported by a transfer risk assessment where needed [2]. On-premise software helps by avoiding transfers altogether, or by allowing anonymization before any export so that the shared files are outside data protection scope if robustly anonymized [1][2].

Download a demo to evaluate on-premise processing that keeps raw footage within your environment.

Risk points businesses often miss

• Re-identification risk. Even after face blurring, subjects can be identified from clothing, gait, location uniqueness, or recurring patterns across posts. Risk depends on who will access the footage and what external data they may combine it with [4].
• Background identifiers. Whiteboards, workstation screens, door signs, uniforms with names, and unique interiors can expose identity. Background masking or selective redaction is frequently required for enterprise publishing.
• Metadata. EXIF GPS coordinates, device serials, time and date, and editing history can link to a person or place. Removing metadata before publication is a common compliance approach described in regulators’ good-practice materials (noting that guidance may differ by context) [5].
• Detection errors. Automated face and plate detectors may miss small, occluded, or angled subjects. False negatives create compliance risk. False positives can over-redact and reduce utility. Quality assurance on representative samples and maintaining versioned processing settings are effective safeguards.
• Children in footage. Children’s images increase risk and public sensitivity. Where identification remains possible, organisations often adopt stricter minimisation and validation before sharing or publishing.

Tooling choices and on-premise software

Cloud services can be efficient but may trigger cross-border transfer analysis and additional security requirements. On-premise software allows processing directly on secure infrastructure, supports data locality controls, and simplifies vendor risk management for raw footage. It also enables pre-transfer anonymization so that downstream content is likely outside GDPR scope if robustly anonymized. Performance and cost outcomes are context-dependent and vary by video resolution, scene complexity, and automation level.

Contact us to discuss on-premise visual data anonymization aligned with internal security policies.

FAQ - Visual Data Sharing with Third Parties

Q1: Does face blurring always make footage anonymous?

Not always. If people remain identifiable via clothing, context, or recurring appearances across posts, the footage may still be personal data. Additional masking and metadata removal are often needed [1][4].

Q2: When should license plate blurring be applied?

Whenever number plates are visible and the footage will be shared or published. Plates can be personal data (in particular where they enable identification directly or indirectly), and usually require redaction unless a clear lawful basis applies and the risk is acceptable.

Q3: Are automated tools enough without human review?

Automated tools reduce workload, but detection errors occur. A proportionate human review of samples is a common compliance approach, especially for high-risk or public releases.

Q4: How does on-premise software help with data transfers?

Processing locally avoids sending raw visuals to external processors. If anonymization is robust before any export, the resulting files may be outside GDPR or UK GDPR transfer rules because they are no longer personal data [1][2].

Q5: Do the three exceptions remove all GDPR duties?

No. The listed exceptions concern image rights and are context-dependent. If individuals remain identifiable, GDPR or UK GDPR obligations can still apply, including transparency and minimisation.

Q6: What should be removed from metadata?

Common practice includes removing GPS coordinates, device IDs, timestamps, creator fields, and embedded thumbnails that could enable linkage.

Q7: Is a DPIA required for publishing videos?

It depends on scale, context, and risk. Large-scale systematic monitoring or other high-risk processing may trigger a DPIA under GDPR or UK GDPR. Anonymization can reduce residual risk.