Article 9(1) GDPR specifies the kinds of personal data that are subject to special protection (corresponding in general to so-called under the old Data Protection Directive ‘sensitive data’) and emphasises at the same time that by default, processing of these data is prohibited. In turn, point 2 of this provision gives a set of exceptional situations in which processing of special categories of personal data is permitted. In other words, the rule prohibiting the processing of special categories of data is not absolute.
The list of types of personal data given in Article 9(1) GDPR is a closed list, and therefore only the types of data listed can be considered special categories of data. This is less obvious than it may seem because data commonly called ‘sensitive data’ often refer to an official identification number, bank account number, information about salary or more widely even to personal data as a whole. It has to be stressed that these are not sensitive data in the meaning of the GDPR. Coming back to the list in the provision in question, the following are mentioned distinctly among special categories of data:
- 1)data revealing racial or ethnic origin;
- 2)data revealing political opinions, or religious or philosophical beliefs;
- 3)data revealing trade union membership;
- 4)genetic data;
- 5)biometric data for the purpose of uniquely identifying a natural person;
- 6)data concerning health or sex life or sexual orientation.
Some types of data among those listed are clearly defined in Article 4 GDPR. Under this provision, genetic data should be understood to mean ‘personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question’ (Recital 13). Meanwhile, biometric data are defined as ‘personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data’ (Recital 14). Data concerning health should be understood to be information ‘related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status’ (Recital 15).
The exceptions to the rule prohibiting the processing of sensitive data are as follows (Article 9(2) GDPR):
- 1)[consent] the data subject has given explicit consent to the processing of those data;
- 2)[employment law] processing of data of this type is provided for in an existing employment relationship so far as it is authorised by EU or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
- 3)[vital interests of those who are unable to consent] processing is necessary to protect the vital interests of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent;
- 4)[not-for-profit body] processing is carried out in the course of its legitimate activities by a foundation, association, or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes;
- 5)[‘self-disclosure’] processing relates to personal data which are manifestly made public by the data subject;
- 6)[legal claims] processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
- 7)[statutory law] processing is necessary for reasons of substantial public interest on the basis of EU or Member State law;
- 8)[healthcare] processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of EU law or Member State or pursuant to contract with a health professional;
- 9)[public health] processing is necessary for reasons of public interest in the area of public health;
- 10)[public archiving, science, history, statistics] processing is necessary for archiving purposes in the public interest, scientific or historic research purposes or statistical purposes in accordance with Article 89(1) GDPR based on EU law or Member State law.
#6.1 ‘Explicit’ Consent for Processing Special Category Data
Article 9(2)(a) GDPR requires a consent for processing special category data to be ‘explicit’. As consent should consist of ‘a clear affirmative act establishing a freely given, specific, informed and unambiguous’ act of a data subject (Recital 32 GDPR), what more ‘explicit’ means? Trying to differentiate ‘a clear affirmative act’ from ‘explicit’ we may demand that a data subject should explicitly state they are consenting to the processing their particular special category data – so a formal question should be asked, e.g. ‘Do you consent to processing by us the XXX Bank data relating to your health you provided us with for the purpose of granting you loan repayment vacation or partial relieve based on our discretionary decision?’. Of course, a reasonable man could ask: ‘For what other sake a bank’s debtor would send the bank her/his tumour diagnosis and treatment documentation accompanied by pictures of her/his three children if not to get loan repayment vacation?’. But in case a debtor sends the bank his spouse’s tumour diagnosis and treatment documentation even a reasonable man would agree that a documented explicit consent of that spouse should be required.
We discuss consent and its requirements in more detail in the following chapter about consent.
#6.2 Processing in Connection with an Employment Relationship Is Lawful
The law or a collective bargaining agreement may allow special category data processing (e.g., detailed data about the state of health of persons working in the foodstuff sector) when required under the employment relationship. It is assumed that this applies both to employees on employment contracts and persons working under civil law agreements (according to the method of classification of employees and service providers adopted by the Belgian Commission de la protection de la vie privée for the purpose of RDPAs).
#6.3 Protection of Vital Interests
As mentioned when describing similar grounds for processing ordinary data under Article 6(1)(d) GDPR, the grounds for processing special category data to protect vital interests require that the data subject be physically or legally incapable of giving consent to personal data processing. Such a situation may arise, for example, due to a particular state of health (state of unconsciousness) as a result of legal incapacitation, or in the case of a child. Formally it narrows a catalogue of events when you may justify processing special categories of personal data to protect the vital interest of a person. Inability to consent may result from unconsciousness or being a person formally not allowed to decide on her/himself (e.g., a minor). In practice, this gap might not be as big as it seems as it may be narrowed to a situation when you are processing personal data of a person against a will of a data subject – allowed for ordinary data, not allowed for special category data.
#6.4 Membership of an Association
Associations of various kinds are authorised to process sensitive data of their members, former members and supporters if those data are related to the association’s activities. This relates to not-for-profit organisations such as political parties, foundations, and associations. For example, a political party is authorised to process data about its members’ political views. The wording of Article 9(2)(d) GDPR is interesting. It stems from it that an organisation is allowed to process special categories data of its opponents who are actively communicating with that organisation. It is not the conclusion that is surprising but the fact that you really need to speculate to get to the real meaning of that rule.
#6.5 Data Made Public/Self-Disclosure
It is permitted to process sensitive data if it is obvious that the person concerned made the data public themselves. These grounds could be called ‘celebrity exemption’ because they are based on the assumption that it is permitted to process sensitive personal data of the person concerned if that person manifestly makes them public, for example during an interview for the glossy press or television. However, we would not rely on this ground when citing information from celebrity gossip sites.
#6.6 Court Cases
It is permitted to process special data in order to establish, exercise or defend legal claims. In a similar way, under the GDPR, it is possible for courts to process such data when acting in their judicial capacity.
#6.7 Important Public Interest in Reality Just: ‘Based on Law’
The notion of relying on important public interest appears in the context of the grounds provided for in Article 6(1)(e) GDPR, and thus the comments made above apply here. In turn, a reference is also made to public interest, but in the context of public health, in Article 9(2)(i) GDPR. A similar situation arises with regard to the grounds in Article 9(2)(j) GDPR, but in this case the public interest arises due to scientific or historical research or for statistical purposes as provided for in Article 89(1) GDPR or under EU law or Member State law.
Organisations operating in the healthcare sector also have grounds for processing sensitive data. The provision in question lists numerous data processing purposes, and these include preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services. Processing of special category data on these grounds must be necessary to achieve the purposes defined above and provided for in EU or national law or under a contract with a health professional (this should be a professional who is subject to an obligation of secrecy or a person for whom that professional is responsible, or other person subject to a professional obligation of secrecy).
But let us get back to Earth. A reader will not find out in Article 9 GDPR any exemption directly allowing to process special categories of data based on a Member State’s law. But yes, Article 9(2)(g) GDPR in reality constitutes such basis. The trick is not for businesses or any other normal organisations. It is for the EU bodies and Member States to dispute if a particular Member State law is compatible with Article 9(2)(g) GDPR or not. ‘Lay’ businesses and organisations should just rely on the local EU Member State law and Article 9(2)(g) GDPR when the processing of special category data is allowed or required under that Member State law.
#6.8 Data on Criminal Convictions
Data on convictions, breaches of law and related security measures (safeguards) are not included in the catalogue of special category data under the GDPR personal data protection system. Nevertheless, the processing of such data continues to be regulated and it is possible only if a specific provision of a Member State’s or EU’s law exists or when ‘under the control of official authority’ (Article 10 GDPR) and subject to existence of a legal basis of processing defined in Article 6 GDPR. Rules on the processing of data on criminal convictions are laid down in more detail in the so-called Police Directive, which was passed at the same time as the GDPR.