Special categories of personal data

What it means

Special categories of personal data are sensitive information whose misuse can seriously harm a person: data on health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic and biometric data used for unique identification, and data on sex life or sexual orientation.

The GDPR prohibits processing them in principle. It is allowed only where, alongside an ordinary lawful basis, one of the statutory exceptions also applies, such as explicit consent, obligations in employment and social security law, or the establishment of legal claims.

They differ from ordinary personal data in their stricter regime. Data on criminal offences and convictions are treated separately: they are not a special category, but they may be processed only under official authority or where the law permits it.

How it works in practice

Employers meet them routinely: sick notes, fitness-for-work assessments, disability information for statutory relief, or deductions of union dues. They process them under employment legislation and only to the extent necessary, for example without the diagnosis.

An attendance system based on fingerprints or facial recognition works with biometric data. Before introducing one, the employer must assess whether it is truly necessary or whether a card or PIN would do. Large-scale processing requires a data protection impact assessment.

An organisation whose core activity is large-scale processing of special categories, such as a healthcare provider, must appoint a data protection officer. Access is restricted to a small circle of people, the data are stored separately and usually encrypted.

What to watch out for

Sensitive data can also be obtained indirectly. An ID photo, a pharmacy purchase history or a note about dietary requirements can reveal health or religion. Analytics and profiling must be checked for whether special categories are being inferred from ordinary data.

A breach involving these data has more serious consequences than a leak of ordinary contacts. A leak of health records almost always requires notifying both the authority and the people affected, and fines and claims for non-material damage tend to be higher.