Special Categories of Personal Data
Which data categories are particularly sensitive under Article 9 GDPR, why a general processing prohibition applies to them, and under which exceptions processing may nonetheless be permitted.
Article 9 GDPR protects certain categories of particularly sensitive personal data through a general prohibition on processing. The special categories of personal data include: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data processed for the purpose of uniquely identifying a natural person; data concerning health; and data concerning a person's sex life or sexual orientation.
Why Special Protection?
The justification for this heightened protection lies in the particular vulnerability associated with these categories. The disclosure of political opinions or health data, for example, may lead to discrimination, social exclusion, or serious material disadvantage. Recital 51 GDPR therefore stresses that such data should not be processed unless specifically permitted.
Exceptions to the Processing Ban
The processing prohibition is not absolute. Article 9(2) GDPR provides ten exceptions: explicit consent of the data subject, the exercise of employment or social security law rights and obligations, vital interests, activities of foundations or non-profit bodies with a political, philosophical, religious, or trade-union aim, data manifestly made public by the data subject, the establishment of legal claims, substantial public interest, preventive or occupational medicine, public health, and archiving, research, or statistical purposes.
For the practically significant ground of explicit consent under Article 9(2)(a), even more demanding standards apply than for regular consent. Consent must be express and given specifically for the particular special category data concerned. Formulations such as 'I consent to the processing of my data' are insufficient.
National Opening Clauses
In Germany, § 22 BDSG supplements the European framework with national opening clauses. It permits processing of special category data for purposes including preventive health care, occupational medicine, and health protection, as well as for the assertion and defence of legal claims, in each case subject to appropriate and specific measures to protect the interests of the data subject.
Particularly careful technical and organisational protection of such data is required. Recommended measures include encrypted storage, strict access controls, pseudonymisation, regular security reviews, and a DPIA under Article 35 GDPR — since the processing of special category data typically constitutes high-risk processing.