This situation is covered by GDPR. GDPR has a "household activities" exemption, which does not apply here because it's the business activity of your landlord. The data is certainly personal data because it's connected to you (even if indirectly, via your apartment number).
Per GDPR, they have an obligation to inform you what data is being collected and for what purpose (Article 14). If they only mention damage photographs, then any photographs that aren't about damage would have been collected unlawfully and you can request they be deleted (Article 17, in particular part 1-d). You also have the right to receive a copy of all data about you (Article 15), and I doubt that any of the usual exceptions apply to this case.
While you can infer so-called Special Category data (sex, sexuality, health conditions), I'm not sure it technically counts as Special Category data on its own. However the inferability of Special Category data should have been part of the consideration of whether this data collection is acceptable.
If the data is transferred to a cloud service, they are obligated to inform you. If this transfer is international, they are obligated to inform you what is the legal basis for the international transfer (but not the actual destination country). If they have told you neither, they are only compliant if the data is entirely on-device or on-premise.
You can file a complaint with ICO, the regulator for the UK.
Thank you for the breakdown, this was my understanding having done some basic GDPR training. I'm aware of the regulator. I've nicely asked questions for now, to see what the answers are.
Per GDPR, they have an obligation to inform you what data is being collected and for what purpose (Article 14). If they only mention damage photographs, then any photographs that aren't about damage would have been collected unlawfully and you can request they be deleted (Article 17, in particular part 1-d). You also have the right to receive a copy of all data about you (Article 15), and I doubt that any of the usual exceptions apply to this case.
While you can infer so-called Special Category data (sex, sexuality, health conditions), I'm not sure it technically counts as Special Category data on its own. However the inferability of Special Category data should have been part of the consideration of whether this data collection is acceptable.
If the data is transferred to a cloud service, they are obligated to inform you. If this transfer is international, they are obligated to inform you what is the legal basis for the international transfer (but not the actual destination country). If they have told you neither, they are only compliant if the data is entirely on-device or on-premise.
You can file a complaint with ICO, the regulator for the UK.