Special categories of data
Special categories of personal data are highly sensitive data under Art. 9 GDPR whose processing is generally prohibited and permitted only under narrowly defined exceptions.
Special categories of personal data – often called „sensitive data“ – are exhaustively listed in Art. 9(1) GDPR: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of unique identification, health data, and data concerning a person's sex life or sexual orientation. These categories are subject to a general prohibition on processing, because their disclosure poses particularly serious risks to the fundamental rights and freedoms of the data subjects.
Processing is only lawful where, in addition to a general legal basis under Art. 6 GDPR, one of the narrowly framed exceptions in Art. 9(2) GDPR applies. These include the explicit consent of the data subject (point a), the fulfilment of employment and social security obligations (point b), the protection of vital interests (point c), processing by political, religious or trade union bodies (point d), data manifestly made public (point e), the establishment or defence of legal claims (point f), and reasons of substantial public interest, preventive healthcare or scientific research (points g to j). National lawmakers further specify several of these grounds; in Germany, for example, Section 22 and Section 26(3) BDSG cover the employment context.
Anyone processing sensitive data must meet heightened duties of care. As a rule, appropriate and specific technical and organisational measures must be in place, a data protection impact assessment under Art. 35 GDPR is frequently required, and stricter standards apply to purpose limitation, access restriction and documentation. Breaching the processing prohibition is among the most serious data protection violations and can attract fines of up to EUR 20 million or 4 % of total worldwide annual turnover. Criminal convictions and offences are governed separately by Art. 10 GDPR and do not fall under Art. 9.
Legal Basis
Art. 9 GDPR; Sections 22, 26(3) BDSG
Practical Example
As part of its occupational health management, a company offers a voluntary flu vaccination and wants to store the participant lists together with vaccination status. Because this involves health data, the data protection officer first examines the legal basis: explicit, voluntary consent from employees under Art. 9(2)(a) GDPR is the most defensible route here, since the prohibition on bundling and the power imbalance in the employment relationship call for particularly careful design. The officer documents the processing in the record of processing activities, restricts access to the company physician, sets a short retention period, and carries out a data protection impact assessment before any data is collected.