Under GDPR, does blurhash of a profile picture count as personal data
<p>Suppose I have a web service where users can have a profile page with name and picture. <a href="https://blurha.sh/" rel="noreferrer">Blurhash</a> is a technology that allows me to create a significantly blurred representation of an image, as a placeholder or thumbnail for the actual image. Suppose I store the blurhash for each profile picture in my web service's database.</p>
<p>Then, if a user requests via GDPR full deletion of their data from my web service, would I be required to delete also their profile picture blurhash? This might overlap with copyright law, and I would like to know if a blurhash is a &quot;derivative work&quot; and thus is my (the company running the web service) creation, not the user's creation.</p>
<p>Here is an example of a blurhash.</p>
<p>The original image (a <a href="https://unsplash.com/photos/ajs2VRTZD7c" rel="noreferrer">public domain picture from Unsplash</a>):</p>
<p><a href="https://i.stack.imgur.com/iaToo.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/iaToo.jpg" alt="enter image description here" /></a></p>
<p>Here is the blurhash code: <code>+GFO+E4n5S~p4n%MRjE101R+-URjt7xu%Laet7ofoeR+xuD*R*n%RQt6n%kCs.tQM{of</code></p>
<p>And here is the blurhash image:</p>
<p><a href="https://i.stack.imgur.com/ItVk6.png" rel="noreferrer"><img src="https://i.stack.imgur.com/ItVk6.png" alt="enter image description here" /></a></p>

<p>From the GDPR's definitions:</p>
<blockquote>
<p>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>
<p>This blurred image would be &quot;information relating to an identified ... natural person (‘data subject’).&quot;  It does not matter whether the person can be identified using the information in question.  Therefore, the answer to your question</p>
<blockquote>
<p>Under GDPR, does blurhash of a profile picture count as personal data</p>
</blockquote>
<p>is <em>yes.</em></p>

internet gdpr