GDPR and Person ReID for event photos: a practical checklist

Person re-identification can help organise photographs in which a participant’s face is turned away, small or hidden. It can also create a persistent technical representation of a person’s appearance. For a dance organiser, photographer or platform, the right GDPR question is therefore not “does this system use a name?” but “what data do we process, for which purpose, under whose responsibility, with what safeguards?”

This article is an operational starting point, not legal advice. GDPR conclusions depend on the exact design, purpose, participants, contracts and national law. Involve qualified counsel and, where applicable, a data protection officer before deployment.

Start by classifying the data and the purpose

The GDPR defines personal data broadly. An event photograph can be personal data when a person is identified or identifiable. Removing a filename or replacing a name with an internal identifier does not necessarily take the photograph outside the GDPR.

Three categories should not be collapsed:

Question	Practical meaning for an event gallery
Is it personal data?	A photograph, crop, account record or vector may relate to an identifiable participant.
Is it biometric data?	Article 4(14) concerns personal data resulting from specific technical processing of physical, physiological or behavioural characteristics that allow or confirm unique identification.
Is Article 9 engaged?	Article 9(1) specifically addresses biometric data processed for the purpose of uniquely identifying a natural person, as a special category of data.

The purpose matters. The same image may be stored as an ordinary event photograph in one operation and subjected to technical processing intended to uniquely identify a person in another. The CNIL’s facial-recognition definition also distinguishes an ordinary photograph from the technical processing that creates and compares biometric templates.

Do not assume that full-body appearance is automatically non-biometric. Conversely, do not state that every full-body embedding is always Article 9 special-category data. Document the characteristics processed, what the comparison is intended to achieve and whether the purpose is unique identification.

Map the workflow before choosing a legal basis

Draw the data flow from ingestion to deletion:

camera files
  → person detection and crops
  → appearance embeddings
  → event-scoped index
  → ranked candidates
  → human review
  → private gallery, publication or sale
  → retention and deletion

For every step, record the controller, any processors and subprocessors, storage location, recipients, security controls and retention period. The controller determines purposes and essential means; a processor acts on documented instructions. Contracts do not replace this factual analysis.

The PolyReID endpoint accepts a crop containing one person and returns an appearance embedding. It does not itself detect people in a full photograph, attach names or decide publication. The Person ReID guide and general system comparison explain that technical boundary, while the API contract exposes the current request and response. The wider gallery architecture remains the deployer’s responsibility.

Lawfulness is a two-layer analysis

Every processing operation needs an Article 6 legal basis. If Article 9 applies, an Article 9(2) condition is also needed; satisfying one layer does not remove the other. The EDPB’s lawfulness guidance summarises the main Article 6 bases and stresses that the chosen basis must fit the real purpose.

Consent is not a decorative checkbox. When relied on, it must meet the applicable conditions, be demonstrable and be as easy to withdraw as to give. Assess whether participation or access is genuinely possible without the matching feature. Legitimate interests, contract or another basis should not be selected from a template without a documented necessity and balancing analysis.

Also separate operations. Matching a participant into a private gallery, publishing a photograph, marketing to that participant and selling a download can have different purposes and legal analyses. A lawful capture does not automatically authorise every later use.

Decide whether a DPIA is required

Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to people’s rights and freedoms. Large-scale special-category processing, systematic monitoring, children, innovative matching and combined datasets can increase risk, but the answer depends on the actual operation.

Use the CNIL DPIA method and the EDPB’s compliance guidance to screen the project. A DPIA should describe necessity and proportionality, identify risks and record measures that reduce them. It is a decision process, not a form completed after launch.

If residual high risk remains that cannot be mitigated, Article 36 may require prior consultation with the supervisory authority.

Design safeguards for an event-photo system

Privacy by design should be visible in the product and operations:

• restrict matching to the relevant competition, day, heat or private collection;
• avoid a reusable cross-event identity index unless it is necessary and specifically justified;
• use the minimum image resolution, metadata and retention needed for the stated purpose;
• separate raw photographs, crops, embeddings and account identifiers with appropriate access controls;
• encrypt data in transit and at rest, log privileged access and test deletion across backups and derived indexes;
• expose results only to authorised participants, reviewers or customers;
• provide a manual or non-biometric route where appropriate;
• set short, documented retention windows and trigger deletion rather than retaining data “just in case”;
• test false matches, missed matches and disparate performance on the real event conditions;
• train reviewers not to treat a similarity score as proof of identity.

The human-review workflow helps contain matching errors, but human review cannot make an otherwise unlawful or unnecessary operation lawful.

Pseudonymisation is useful security and risk reduction, but it is not anonymisation. The CNIL explains that effective anonymisation must prevent individualisation, correlation and inference to a sufficient degree. An event-scoped vector that can still single out the same participant should not be labelled anonymous merely because it contains no readable name.

Give people useful information and effective rights

The privacy notice should use language participants can understand. Explain who controls the processing, the matching purpose, data categories, legal basis, recipients, transfers, retention, rights, complaint route and whether any solely automated decision with legal or similarly significant effects exists.

Provide working routes for access, correction, objection or withdrawal where relevant, restriction and deletion. A correction must propagate to the customer gallery and any cached or exported derivative within scope. For children, assess age-appropriate transparency, parental responsibility and the separate rules that may apply to image rights.

For a ballroom workflow, do not hide matching inside general event terms. The ballroom Person ReID case study shows why profiles, backs, partner occlusion and similar costumes require contextual review. The event-photo comparison of face search and Person ReID helps choose the least intrusive signal capable of meeting the purpose.

Do not treat the AI Act as a GDPR shortcut

The EU AI Act has its own definitions, roles, prohibitions and risk categories. Its biometric-data definition expressly refers to technical processing of physical, physiological or behavioural characteristics and includes examples such as facial images and body shape. Classification still depends on the actual system and intended purpose.

Compliance with one instrument does not establish compliance with the other. Map both regimes, applicable national image-rights rules, consumer law and contractual duties separately.

A launch-gate checklist

Before processing a live event, require a written answer to each question:

1. What exact purpose requires matching, and can a less intrusive method meet it?
2. Which files, crops, vectors and identifiers are personal data?
3. Does the intended processing create biometric data or seek unique identification?
4. Which Article 6 basis—and, if needed, Article 9(2) condition—applies to each purpose?
5. Who is controller, processor and subprocessor at every step?
6. Is a DPIA required, and are residual risks acceptable?
7. How are participants informed, and what is the alternative route?
8. Who can access results, correct mistakes and action rights requests?
9. When are photos, crops, vectors, logs and backups deleted?
10. What evidence shows the safeguards work in real ballroom and action photographs?

Do not launch while an answer is “we will decide later”. A well-scoped dance competition gallery can reduce risk by keeping matching event-bound, reviewable and correctable—but only a case-specific assessment can determine whether the complete operation is lawful.