If you're rolling out generated headshots across a company, or building anything that trains on people's faces, the first thing worth getting straight is where the GDPR line actually falls. Most internal discussions I've seen put it in the wrong place.
The common assumption is that photographs of employees are special category data under Article 9, so consent is required, so send everyone a consent form.
Two of those three steps are wrong.
What Recital 51 says
The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.
So a photograph is ordinary personal data. You need a lawful basis under Article 6, like anything else, but Article 9 and its higher bar don't automatically apply.
What triggers Article 9 is the technical processing, not the image. Run the photo through a model that produces a face template used for matching, and now you're generating biometric data, because the purpose is unique identification.
The distinction is purpose-shaped, which is why it gets muddled.
Where generation sits, honestly
Training a small adapter so a diffusion model can render your face is not identification. Nobody is matching you against a database. The purpose is to draw a picture.
Does that make the intermediate representation biometric data? I don't think the answer is settled, and anyone telling you it obviously is or obviously isn't is overselling their confidence. The regulation was drafted with recognition systems in mind, and generative pipelines don't map cleanly onto it.
What I'd do in practice: treat the model artefact as personal data, because it plainly is, and don't rely on the argument that it isn't Article 9 material if the whole programme falls apart when a regulator disagrees. Build it so the answer doesn't matter much.
That mostly means deletion working properly, which is the part people skip.
Consent is usually the wrong basis at work
This is the one that actually catches companies out, and it has nothing to do with biometrics.
Consent under the GDPR must be freely given. European regulators have taken the consistent position that in an employment relationship, consent is rarely free, because of the power imbalance. Your employee can technically say no to their manager, and everyone involved knows what that costs.
So a consent form for employee headshots is often the weakest basis you could pick, not the safest. It also creates an obligation to make withdrawal as easy as giving it, which nobody builds.
Legitimate interest is usually the more honest fit for a team page, with the balancing test written down and a genuine, low-friction opt-out that doesn't require a conversation.
Which is roughly what good practice looks like anyway. The people who don't want their face on the internet have reasons, and a process that makes them explain those reasons to a manager is bad regardless of what the law says.
The two questions worth asking a vendor
Skip the marketing page. These are the ones that matter:
What happens to the trained model after the images are delivered? Not the photos, the model. The uploads are the obvious artefact and usually the one that gets deleted. The adapter derived from someone's face is the one that gets forgotten, and it's the more sensitive object.
Which subprocessors touch the images, and where? Inference frequently runs somewhere other than the company you're buying from. That's normal, and it needs to be in the record of processing activities you're supposed to maintain either way.
Enterprise vendors should answer both without hesitating. There's a longer treatment of the compliance side of enterprise rollouts if you're the person who has to write this up.
Professional rules are a separate layer
Data protection is not the only rulebook, and in some professions it isn't the binding one.
Lawyers in most US states are subject to bar rules on advertising, which prohibit misleading communications. Whether a generated portrait of yourself counts as misleading is, as far as I can tell, untested. It's your face, and the photograph never existed. Those two facts point in different directions and no bar association I'm aware of has ruled on it.
Real estate has a similar shape, with association and state licensing rules around how agents represent themselves.
I'm not going to tell you where that line is, because nobody knows yet. What I'd say is that the risk is not evenly distributed: a portrait that looks like you on a normal day is a different proposition from one that removes fifteen years. The conservative version of this is easy to identify and most people know it when they see it.
Which is roughly why headshots for lawyers and for estate agents tend to be styled far more conservatively than the tech-industry equivalent. Partly convention, partly that those professions have someone to answer to.
The short version
A photo is personal data. A face template used for matching is biometric data. Generation sits awkwardly between them and probably shouldn't be argued about.
Get deletion right, don't lean on employee consent, and ask vendors what happens to the model rather than the images.
More from this series
- Your CV photo doesn't break the ATS. The layout you built around it does.
- Most AI headshot comparisons are testing the wrong thing
- 5 LinkedIn mistakes that filter engineers out before anyone reads the CV
- Dein LinkedIn-Profilbild wird bei 48 Pixeln entschieden, nicht auf deinem Profil
On BetterPic
Top comments (0)