What is considered personal data for survey company

We are a company that performs in-depth surveys.When we collect data on ethnicity (without collecting any other personal data), is this considered as personal data according to GDPR?

Yes, it is a special category of personal data under Article 9 GDPR which requires some additional safeguards because it is potentially dangerous for data subject’s rights and freedom.

When we record session cookies, is this considered as personal data according to GDPR?

Yes, even session cookies that identify the data subject device are personal data under GDPR even though the data retention period ends with the session.

For some clients, we do in-depth interviews, and we record either videos or images of the interviewees; we send those videos or images in aggregate form to the client (we send no other personal data), and we do not keep track of which part of the video or which image displays which interviewee. If an interviewee wishes her personal data to be deleted, how is this to be executed on our client side if neither we nor they know which part of the video / which photo belongs to this interviewee?"

When dealing with videos, the best option is to let the data subject sign a release in order to make the interviewee renounce any claim on the video which will be transferred to the client without personal data. You will need to state it in the privacy notice that you give the data subject together with the release.

Here you can find more information about data subjects rights:

• Is consent needed? Six legal bases to process data according to GDPR https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/
• Four main questions for obtaining and managing data subjects’ consent under GDPR: https://advisera.com/eugdpracademy/knowledgebase/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/
• Everything you need to know about the GDPR Privacy Notice: https://advisera.com/articles/gdpr-privacy-notice-6-key-elements-to-include/

If you need to understand how to process consent under GDPR, you can consider enrolling in our free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/

Thank you for this.  I am confused though.  I realize that ethnicity is a "special category" of "personal data" but if we don't collect any PII (name, email, IP address, etc) then how is the data subject to exercise their rights for the erasure of the data?   We have nothing to specifically identify the data record after the survey has been completed.