Processing Special Category Personal Data – GDPR Article 9
About
- Key Terminology of GDPR
- Personal Data Incident & Breach Management
- Data Protection Principles & Applications
- Six Legal Bases for Processing – GDPR Article 6
- Data Subject Rights
- Processing Special Category Personal Data – GDPR Article 9
- International Data Transfers
- Personal Data & Scientific Research
- Research Using Health Related Personal Data
- Data Privacy & Security Training
- Data Protection and its Scope
- Data Protection Obligations of the University
- Role of the DPO
Conditions for Processing Special Category Personal Data – GDPR Article 9 (2) a.-j.
Occasions where Article 6 needs to be complemented by Article 9
If you are processing one or more of the ‘special category’ personal data listed below, in addition to your Article 6 legal basis, you also need to consider Article 9. This will be relevant for anyone processing health related data.
Special Category data are:
- Personal data revealing racial or ethnic origin.
- Political opinions.
- Religious or philosophical beliefs.
- Trade union membership.
- Genetic data and biometric data processed for the purpose of uniquely identifying a natural person.
- Data concerning health.
- Data concerning a natural person’s sex life or sexual orientation.
Processing of these special categories is prohibited, except in limited circumstances set out in Article 9 of the GDPR, which are listed below:
Article 9 Conditions:
- Explicit consent
- Employment, social security and social protection (if authorised by law)
- Vital interests
- Not-for-profit bodies
- Made public by the data subject
- Legal claims or judicial acts
- Reasons of substantial public interest (with a basis in law)
- Health or social care (with a basis in law)
- Public health (with a basis in law)
- Archiving, research and statistics (with a basis in law)
If none of the Article 9 Conditions apply to the processing you intent to do, you will not be able to do this processing.