I am not a lawyer, but a computer scientist and researcher. My interpretation of the law is that you need permission as long as you have data belonging to someone or it identifies a person and you must have consent either verbally or in writing. Such data items like name, dob, address are pieces of data that when put together will become information -carries meaning- about a person. A hand on its own does not identify a person; fingerprints will though as it has biometric data which can identify a person, but a photograph of nails doesn't include this biometric data.
In my view, as long as you ask permission - even verbally, it should be fine and gives power to the client to either accept or reject your request.