Special Categories of Personal Data
Article 9 identifies special categories (sensitive) of personal data needing extra protection because their processing risks individuals' fundamental rights. They are: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; plus genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, and data concerning a person's sex life or sexual orientation. Genetic data and data concerning health have their own broad definitions. A photograph is only biometric data when processed by a specific technical means for unique identification - but its purpose may still pull it into Article 9.
| Special category | Note |
|---|---|
| Racial or ethnic origin | Revealing data |
| Political opinions | Revealing data |
| Religious or philosophical beliefs | Revealing data |
| Trade union membership | Revealing data |
| Genetic data | Defined in Recital 34 - unique info on physiology/health from a biological sample |
| Biometric data | Special category only when processed to uniquely identify a person |
| Data concerning health | Defined broadly (Article 4(15), Recital 35) - past, current or future status |
| Sex life or sexual orientation | Revealing data |
Processing photographs is not automatically processing of special-category data. A photo becomes biometric data only when processed through a specific technical means (e.g. facial recognition) that allows unique identification or authentication. But beware the purpose: per EDPB Guidelines 3/2019, footage of someone in a wheelchair or wearing glasses is not per se special data - yet if it is processed to deduce a health condition or other special category, Article 9 applies.
- Data concerning health is read broadly: care-registration data; a health identifier/number; results of testing a body part or substance (including genetic data); and any data on disease, disability, disease risk, medical history, treatment or physiological state - from any source.
- Genetic data gives unique information about physiology or health and typically comes from analysing a biological sample.
- Some 'revealing' categories can be inferred - a photo may reveal racial origin, religion or a disability; the purpose of processing then matters.