Privacy and data for AI headshots

AI headshots GDPR: who handles your staff's photos

Five parties handle the data in the course of a job.

1. Birdie Portraits. runs the service, checks every image and delivers the files to your firm.
2. Kilij Digital. builds and hosts Birdie Me, and holds backup copies, including on Microsoft OneDrive.
3. Amazon Web Services. stores photos, finished headshots and job records in London, in the eu-west-2 region.
4. Replicate. processes images for cut-outs and AI headshots. For a background change, the uploaded photo is deleted as soon as the job finishes; Replicate's records of the job cannot be deleted through its API.
5. Microsoft's email service. sends invitations and notifications.

How consent is recorded

Birdie Me stores each person's consent with the exact wording they saw, and keeps that wording even if it changes later.

The ICO says freely given consent is harder to obtain where there is an imbalance of power, such as between an employer and its staff. Your firm still needs its own lawful basis.

Where the data is stored

Older jobs move to an archive in London with a SHA-256 checksum for every file, and a restored job is checked file by file before it is put back. Files are kept only as long as they are needed to make and deliver the headshots, and anyone can ask for theirs to be deleted.

Are staff photos biometric data?

According to the ICO, a digital photograph is not automatically biometric data. It becomes biometric data when specific technical processing is used, such as creating a template for automated matching. The ICO's guidance does not deal with AI-made portraits directly. Your lawful basis, the controller and processor roles and any transfer assessment are questions for your own data protection adviser.