Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 9
Processing of special categories of personal data
Chapter 2|Principles|📖 11 min read
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
(e) processing relates to personal data which are manifestly made public by the data subject;
(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
4. Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.
Understanding This Article
Article 9 establishes the GDPR's highest level of protection for particularly sensitive categories of personal data that, if misused, could lead to discrimination, stigmatization, or serious harm to individuals. The article creates a general prohibition on processing these data types, then provides limited, specific exceptions under which processing may occur with strict safeguards.
The Special Categories (Paragraph 1):
The prohibition covers data revealing: (1) racial or ethnic origin; (2) political opinions; (3) religious or philosophical beliefs; (4) trade union membership; (5) genetic data; (6) biometric data for unique identification purposes; (7) health data; and (8) data concerning sex life or sexual orientation. These categories reflect areas where historical discrimination and persecution have occurred, or where data is intimately personal and warrants heightened protection. The prohibition applies to data 'revealing' these characteristics - even if the data doesn't explicitly state the sensitive attribute, if it reveals or allows inference of the attribute, Article 9 applies. For example, a photo might be biometric data if used for identification purposes, or pharmacy purchase records reveal health information.
Explicit Consent (2(a)):
Unlike regular consent under Article 6(1)(a), special category processing requires 'explicit' consent - a clear, specific statement (not implied from actions). This might be a signed declaration, recorded oral statement, or checked box with explicit language confirming agreement. However, explicit consent alone isn't always sufficient - some Union or Member State laws prohibit processing certain special categories even with consent, particularly for genetic data or in employment contexts where power imbalances make truly free consent impossible.
Employment and Social Protection (2(b)):
Processing is allowed when necessary for employment obligations or rights in areas like workplace health and safety, disability accommodations, or social security benefits. This must be authorized by law or collective agreements and include appropriate safeguards. For example, an employer might process health data to accommodate a disability, but only to the extent necessary and with safeguards against misuse or discrimination.
Vital Interests (2(c)):
Similar to Article 6(1)(d) but narrower - applies when necessary to protect life or physical well-being and the person cannot consent (unconscious, child in emergency, etc.). This is limited to situations where other legal bases aren't available and genuine life-or-death urgency exists.
Not-for-Profit Bodies (2(d)):
Political parties, religious organizations, trade unions, philosophical associations, and similar not-for-profit bodies can process members' special category data related to their mission, provided processing relates to members/former members/regular contacts, appropriate safeguards exist, and data isn't disclosed externally without consent. This allows such organizations to function while protecting individual rights.
Data Made Public (2(e)):
If individuals have 'manifestly' made their special category data public (posting online, public speeches, etc.), processing is allowed. 'Manifestly' means clearly and obviously public - not merely technically accessible. However, this doesn't provide blanket permission for any processing; it must still comply with other GDPR principles like purpose limitation and fairness.
Legal Claims (2(f)):
Processing is permitted when necessary for establishing, exercising, or defending legal claims, or when courts act in judicial capacity. This ensures access to justice isn't impeded by data protection rules - litigation often necessarily involves sensitive data.
Substantial Public Interest (2(g)):
Processing is allowed for substantial public interest purposes based on proportionate law that respects data protection rights and includes specific safeguards. Examples include fraud prevention, regulatory compliance, safeguarding vulnerable persons, or journalistic purposes. The basis must be in Union or Member State law - controllers cannot self-declare a 'substantial public interest.'
Healthcare (2(h)):
Processing for preventive/occupational medicine, medical diagnosis, healthcare provision, or health system management is permitted when based on law or contract with health professionals and subject to professional secrecy (paragraph 3). This enables healthcare delivery while requiring medical confidentiality protections.
Public Health (2(i)):
Processing for public health purposes like protecting against serious health threats, ensuring healthcare quality standards, or medicinal product safety is allowed based on law with specific safeguards, particularly professional secrecy. The COVID-19 pandemic demonstrated this exception's importance.
Archiving, Research, Statistics (2(j)):
Processing for public interest archiving, scientific/historical research, or statistics is permitted under proportionate law with safeguards as specified in Article 89(1). This balances advancing knowledge with protecting individuals, often through pseudonymization, access controls, and minimization techniques.
Professional Secrecy (Paragraph 3):
Health data processing under exception (h) must occur by or under responsibility of someone bound by professional secrecy (doctors, nurses, psychologists, etc.) under law or professional body rules. This ensures confidentiality beyond general data protection requirements.
Member State Discretion (Paragraph 4):
Member States can impose additional conditions or limitations on genetic, biometric, or health data processing beyond GDPR's requirements, creating potential variation across the EU but ensuring no weakening of protections.
Key Points
Processing of special categories of data (racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, sexual orientation) is generally prohibited
Ten specific exceptions allow processing under strict conditions, including explicit consent, employment/social security obligations, vital interests, and substantial public interest
Explicit consent is required (not just regular consent), meaning a clear, specific statement - but some laws may prohibit lifting the prohibition even with consent
Health data processing for healthcare purposes requires professional secrecy obligations and must be conducted by or under responsibility of healthcare professionals
Member States can impose additional restrictions on processing genetic, biometric, or health data beyond GDPR requirements
Practical Application
Explicit Consent Example: A genetic testing company offering ancestry analysis requires customers to check a box stating: 'I explicitly consent to [Company] processing my genetic data to provide ancestry analysis and health risk reports.' This clear, specific statement constitutes explicit consent. Merely accepting general terms and conditions wouldn't suffice. The company maintains records of exactly when and how consent was obtained.
Healthcare Example: A hospital processes patient health data to provide medical treatment. This relies on exception 2(h) - healthcare provision. The processing is conducted by doctors and nurses bound by medical professional secrecy under law. The hospital doesn't need patient consent under Article 9 for treatment purposes (though consent may be required under medical ethics or national healthcare laws), but must still comply with transparency obligations and other GDPR requirements.
Employment Reasonable Accommodation: An employee discloses a disability to their employer and requests workplace accommodations. The employer processes this health data under exception 2(b) - employment law obligations related to disability accommodation. The employer limits access to HR staff on a need-to-know basis, doesn't share the information with managers beyond what's necessary for accommodations, and implements security measures to protect the data.
Political Party Example: A political party maintains a database of member information including their political opinions and activities. This processing relies on exception 2(d) - not-for-profit body with political aims processing members' data. The party implements safeguards ensuring data isn't disclosed to third parties without member consent, limits access to authorized staff, and uses the data solely for party activities and member communications.
Public Health Crisis Example: During a disease outbreak, public health authorities process health data (testing results, contact tracing information) to track disease spread and protect public health. This relies on exception 2(i) - public health purposes. The processing is based on public health law, includes specific safeguards like professional secrecy for health workers, access controls, and purpose limitations ensuring data isn't repurposed for unrelated activities.
Medical Research Example: A university conducts medical research studying genetic factors in disease. The research processes genetic and health data under exception 2(j) - scientific research. The researchers implement Article 89(1) safeguards including: pseudonymization of data, strict access controls limiting which researchers can access identifiable data, ethical review board approval, secure data storage, and data minimization (only collecting necessary data). Results are published in aggregate without identifying individuals.
Biometric Authentication Example: An employer implements fingerprint scanners for building access. This processes biometric data for unique identification. The employer must identify a valid Article 9 exception - explicit consent might be appropriate if voluntary, or employment obligations under 2(b) if required for legitimate security purposes and authorized by law/collective agreement. The employer conducts a Data Protection Impact Assessment given the high-risk nature, implements encryption and access controls for fingerprint templates, and ensures employees understand the processing.
Data Made Public Example: A politician publicly discloses their religious beliefs in a speech. A news organization reports on these statements, processing the politician's religious belief data under exception 2(e) - data manifestly made public. However, the news organization still must comply with purpose limitation (reporting on the public statement, not repurposing for unrelated uses) and other GDPR principles.
Legal Claims Example: An employment discrimination lawsuit involves processing the plaintiff's race and medical conditions - special category data. Both parties can process this data under exception 2(f) - necessary for legal claims. However, processing should be limited to what's genuinely necessary for the case, with appropriate security measures and confidentiality protections (legal professional privilege, court confidentiality rules).
Insurance Genetic Data Prohibition: An insurance company wants to require genetic testing and process results to assess risk and set premiums. However, many Member States have laws prohibiting this processing even with explicit consent, recognizing the discrimination risk and power imbalance. The company cannot process this data despite being willing to obtain explicit consent, because national law prohibits lifting the Article 9(1) prohibition as permitted by exception 2(a).
Violation Example: A marketing company purchases data about individuals' health conditions from a data broker to target pharmaceutical advertisements. This processing lacks a valid Article 9 exception - the individuals didn't provide explicit consent, no employment/healthcare/public interest basis exists, and the data wasn't manifestly made public. This violates Article 9's prohibition and could result in significant fines.
Multi-Layered Protection: A mental health counseling app processes highly sensitive health data. The app requires: (1) explicit consent meeting Article 9(2)(a) requirements; (2) processing by or under responsibility of licensed mental health professionals meeting paragraph 3's professional secrecy requirements; (3) encryption and security measures exceeding standard requirements given data sensitivity; (4) strict purpose limitation; and (5) a Data Protection Impact Assessment. This illustrates how Article 9 processing often requires multiple safeguards layered together.
Best Practices: When processing special category data: (1) confirm you have a valid Article 9(2) exception; (2) implement heightened security measures appropriate to the sensitivity; (3) conduct Data Protection Impact Assessments; (4) apply strict purpose limitation and data minimization; (5) provide enhanced transparency to data subjects about special category processing; (6) implement stringent access controls; (7) ensure staff handling such data receive specialized training; (8) consider pseudonymization and encryption; (9) regularly review continued necessity; and (10) maintain detailed documentation of your legal basis and safeguards.