Ask a Question

What Is Video Anonymization and Image Rights Under Copyright Law?

Table of Contents

Video anonymization and image rights under copyright law is a compliance issue that involves the simultaneous application of personal data protection rules, the protection of personal rights, and the rules governing the dissemination of a person’s likeness captured in photographs and video recordings. In practice, this means assessing whether, before publishing, sharing, archiving, or transferring material, you should blur a face or license plate to reduce the identification of a natural person while also complying with legal requirements relating to consent for the use of a person’s image.

Under Polish law, there are at least three regulatory layers to consider. First, the GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 — applies where an image makes it possible to identify a person directly or indirectly. Second, Articles 23 and 24 of the Polish Civil Code protect personal rights, and a person’s image is generally covered by that legal framework. Third, Article 81 of the Polish Copyright and Related Rights Act of 4 February 1994 governs the dissemination of a person’s likeness. These legal regimes are not identical. Material may comply with one of them while still requiring protective measures from the perspective of another.

In the context of photo and video anonymization, the main risk-reduction measure is the permanent, or at least practically irreversible, blurring of faces and, in many jurisdictions, license plates as well. If blur, pixelation, or an AI mask is used, it should reduce the probability of re-identification to a level that is appropriate for the processing purpose and the context in which the material will be shared.

The most common problem is that the data controller analyzes only consent for publishing a person’s image while overlooking obligations arising under the GDPR. However, consent under Article 81 of the Copyright Act does not replace a lawful basis for processing personal data under Article 6 GDPR. The reverse is also true. A GDPR lawful basis alone does not remove the obligation to obtain consent for the dissemination of a person’s likeness unless a statutory exception applies.

In practice, this means two separate questions must be assessed: whether the image of a person may be processed at all, and whether their likeness may be disseminated without anonymization. In many cases, anonymizing the material before publication or before transfer outside the organization is the compliant and proportionate solution.

Area

Legal Basis

Protected Interest

Relevance for Photos and Video

GDPR

EU 2016/679, Arts. 4, 5, 6, 25, 32

Personal data and processing principles

A face, and sometimes a license plate, may enable identification

Polish Civil Code

Arts. 23–24

Personal rights

Protects against unlawful infringement independently of the GDPR

Copyright law

Art. 81 of the 1994 Act

Dissemination of a person’s likeness

Requires consent unless a statutory exception applies

When Face Blurring Is Required in Practice

In photo and video materials, the face is usually a direct identifier. For that reason, face anonymization is a standard data minimization and privacy by design measure. In practice, the need to blur faces arises in particular where the material is intended for publication, transfer to an external entity, disclosure in response to an access request, or use in training workflows.

Under Polish and EU law, it should be remembered that image rights protection is not absolute. For image rights purposes, three practical exceptions are particularly relevant when assessing visual materials:

  • a well-known person shown in connection with the performance of public functions, especially political, social, or professional ones,
  • the person’s image is merely a detail of a larger whole, such as a gathering, landscape, public event, concert, or sports event,
  • the person received agreed remuneration for posing and no explicit restrictions on use were reserved.

Even where these exceptions apply, the proportionality and purpose of publication must still be assessed. A copyright-law exception does not always end the GDPR analysis. If the material creates a high risk of identification and further profiling, video anonymization may still be the appropriate measure.

Photo and Video Anonymization Technologies

In modern systems, face blurring and license plate blurring are based on object detection in images. In practice, deep learning models are used, usually convolutional neural networks or one-stage and two-stage detection architectures. An AI model must first be trained on labeled datasets so that it can recognize faces under different conditions, including angle, lighting, partial occlusion, motion, and low resolution.

After detection, the system applies an anonymization mask to the detected area. Typical techniques include:

  • blur — Gaussian blur or a similar method,
  • pixelation,
  • solid mask — full coverage of the area,
  • cross-frame tracking — keeping the mask on the same object over time.

In Gallio PRO, automatic anonymization applies only to faces and license plates. The software does not automatically detect logos, tattoos, name badges, documents, or content displayed on monitors. Such elements may be blurred manually in the editor. Gallio PRO does not perform video stream anonymization or real-time anonymization. This is important when selecting the right workflow and assessing risk.

Key Parameters and Metrics for Video Anonymization

A compliance assessment should not be limited to stating that the material has been blurred. Measurable parameters for detection quality and anonymization effectiveness are needed. This matters for audits, acceptance testing, and DPIAs.

The following technical metrics are commonly used:

  • detection recall — the percentage of faces or license plates correctly detected,
  • precision — the percentage of correct detections among all detections,
  • miss rate — the share of objects that were missed, which is critical from a compliance perspective,
  • IoU — Intersection over Union, a measure of how well the mask fits the object,
  • processing time per file or per minute of footage,
  • the percentage of frames without a mask when tracking an object over time.

As a simplification, the following formula can be used: anonymization effectiveness = 1 − miss rate for legally relevant objects. If a face appears in 300 frames and is not blurred in 9 of them, the miss rate is 3%. For published material, the risk may still be too high, especially where the missing mask occurs in key frontal shots.

There is some interpretive divergence with respect to license plates. In many Western European countries, license plate blurring is standard practice based on national law, the practice of supervisory authorities, and a broad understanding of whether a person can be identified. In Poland, the situation is less clear-cut.

On the one hand, the Polish DPA (UODO), the EDPB, and the case law of the CJEU support a functional approach: if a registration number can lead to the identification of a person using means reasonably likely to be used, it may fall within the scope of protection. On the other hand, some case law and statements by administrative courts have held that a license plate does not always constitute personal data in itself. In compliance practice, blurring license plates before publishing material is the safer approach, especially where the image also reveals location, time, vehicle make, or any other context enabling identification.

Practical Solutions for DPOs and Operational Teams

The most useful approach is to separate the legal assessment stage from the technical processing stage. This makes it easier to demonstrate accountability under Article 5(2) GDPR while also reducing the risk of infringing image rights.

  • define the purpose of using the material — archive, publication, training, or response to a request,
  • assess whether the face or license plate enables identification,
  • verify whether there is a lawful basis under Article 6 GDPR and whether consent is required under Article 81 of the Copyright Act,
  • apply automatic face blurring and license plate blurring, and manually mask elements not detected automatically,
  • review the material after anonymization at the frame level and in problematic shots,
  • document the decision criteria, file version, and scope of intervention.

Process security is also important. In an on-premise model, it is easier to limit data transfers outside the organization. This matters for CCTV footage, internal investigations, and recordings from high-risk areas. Secondary data should also be minimized. Gallio PRO does not store logs containing personal data in the form of detected faces and license plates, nor logs containing special category data.

Any assessment should be based on primary legislation and official guidance. In this area, it is best to rely on source documents rather than secondary commentary without proper legal grounding.

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 — GDPR.
  • Polish Copyright and Related Rights Act of 4 February 1994 — Article 81.
  • Polish Civil Code of 23 April 1964 — Articles 23 and 24.
  • EDPB Guidelines 4/2019 on Article 25 GDPR — Data Protection by Design and by Default, version adopted on 20 October 2020.
  • CJEU case law on the broad interpretation of identifiability and personal data, used as supporting authority when assessing images and license plates.
  • Guidance and positions of the Polish DPA (UODO) on the publication of photos and recordings and on assessing whether individuals are identifiable.

See Also

  • Video data anonymization
  • Face blurring
  • License plate blurring
  • GDPR compliance in video and photo processing

See also

Back to Glossary