Module 4 · Special-category data and Article 9 exceptions
Processing special-category data is prohibited by default. To do it lawfully you need BOTH an Article 6 basis AND an Article 9 exception. The exceptions include explicit consent, employment/social-security law, vital interests where the person cannot consent, data manifestly made public, legal claims, substantial public interest, and health/medicine grounds.
Special-category data is prohibited by default. To process it lawfully you need BOTH an Article 6 lawful basis AND an Article 9 exception. One key is never enough.
| # | Exception | Key condition |
|---|---|---|
| 1 | Explicit consent | Higher-bar consent; still unambiguous, freely given, specific, informed; a clear affirmative act, usually expressly recorded |
| 2 | Employment / social security / social protection law | Necessary to comply with obligations or exercise rights; needs a supporting law |
| 3 | Vital interests | Where the data subject is incapable of giving consent (e.g. unconscious) |
| 4 | Political/philosophical/religious/trade-union bodies | About members/former members/regular contacts, with safeguards; no disclosure outside without consent |
| 5 | Manifestly made public by the data subject | E.g. data the individual published on an open profile |
| 6 | Establishment, exercise or defence of legal claims | Must show necessity (close, substantial connection) |
| 7 | Substantial public interest | Narrower than under the Directive; needs a Union/Member State legal basis with safeguards |
| 8 | Medicine and social/health care | Diagnosis, treatment, occupational medicine, managing health systems; on EU/Member State law or a contract |
| 9 / 10 | Public health; archiving/research/statistics | Public-interest grounds with safeguards |
Explicit consent is the strictest form: it must be informed and an unbundled, clear affirmative act, usually expressly recorded (e.g. a signed digital agreement). Bundling it into the terms of use, hiding it in a notice, or pre-checking a box all fail.