Under the GDPR, ‘personal data’ means “any information relating to an identified or identifiable natural person”. But there’s another type of personal data, called ‘special category’ data (sometimes called ‘sensitive’ personal data), in relation to which extra care must be taken.
Definition Under the GDPR
Personal data is ‘special category’ if it relates to:
- racial or ethnic origin
- political beliefs
- religious or philosophical beliefs
- trade union membership
- genetic or biometric data
- physical or mental health
- sex life or sexual orientation
What Does the GDPR Definition Really Mean?
Special category data is broadly similar to the previously titled ‘sensitive’ personal data under the old Data Protection Act 1998 but now includes genetic and biometric data and excludes criminal conviction data (which is now a category in its own right).
Lawful Grounds for Processing Special Category Data
As well as applying additional safeguards, you will also need to identify additional grounds for the processing of special category data. You will need to identify a lawful basis under Article 6 AND under Article 9. The two do not need to be linked, but often are. Article 9 grounds include:
- The data subject has given their explicit consent;
- The processing is carried out in pursuance of its legitimate activities by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union;
- The processing relates to personal data which has been manifestly made public by the data subject;
- The processing is necessary:
- for the purposes of carrying out the obligations and exercising specific rights of either controller or data subject in the field of employment, social security or social protection law in so far as it is authorised by member state law;
- to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
o for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
- for reasons of substantial public interest;
- for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services;
- for reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.