What are Special Categories of Personal Data?
Article 9 of the GDPR identifies certain categories of personal data as 'special' because they are particularly sensitive. Processing of these data types is generally prohibited unless specific conditions are met.
Types of Special Category Data
Special categories include personal data revealing:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data (for the purpose of uniquely identifying a natural person)
- Health data
- Sex life or sexual orientation
General Prohibition
Article 9(1) prohibits the processing of special category data. However, Article 9(2) provides specific conditions under which such processing is permitted.
Conditions for Processing
Processing is permitted when:
- The data subject has given explicit consent for specific purposes
- Processing is necessary for employment, social security, or social protection law
- Processing is necessary to protect vital interests when the data subject is incapable of giving consent
- Processing is carried out by certain non-profit bodies (e.g., political, philosophical, religious organizations)
- Processing relates to data manifestly made public by the data subject
- Processing is necessary for legal claims or judicial acts
- Processing is necessary for substantial public interest (with basis in law)
- Processing is necessary for health or social care purposes
- Processing is necessary for public health purposes
- Processing is necessary for archiving, research, or statistical purposes in the public interest
Additional Safeguards
When processing special category data, organizations must implement appropriate safeguards including:
- Enhanced security measures
- More restrictive access controls
- Encryption or pseudonymization where appropriate
- Staff training on handling sensitive data
- Careful consideration in DPIAs
Criminal Conviction Data
Article 10 provides that processing of personal data relating to criminal convictions and offences must be carried out only under the control of official authority or when authorized by law.