Special categories of personal data

Special categories of personal data are information that receives a higher level of protection because of its sensitivity. Article 9(1) GDPR covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership. It also covers genetic data, biometric data used for the purpose of uniquely identifying a natural person, health data and data concerning a person’s sex life or sexual orientation.

Processing these data is prohibited in principle. It may be lawful only where there is an appropriate legal basis under Article 6 GDPR and an exception under Article 9(2) GDPR. Depending on the situation, the exceptions include explicit consent, specific obligations in employment or social security law, protection of vital interests and substantial public interest. A label such as “score”, “segment” or “attribute” does not settle the question. An inferred or predicted attribute may also fall within Article 9 if it is linked to a person and reveals a protected characteristic or opinion.

For businesses, the assessment therefore covers the complete data flow, from collection and inference to use and disclosure. The purpose, source, recipients, access controls, deletion and documented legal assessment must fit together. In marketing, profiling or new digital products, the classification should be considered alongside marketing, cookies and tracking and privacy compliance and governance.