GDPR: photographs are biometric only when processed to identify | Yap