Special categories of personal data

Special categories of personal data are particularly sensitive information relating to natural persons, the processing of which is subject to additional data protection requirements. Examples include health data, information about religious beliefs, genetic data and biometric data used for the purpose of uniquely identifying an individual. Article 9(1) GDPR establishes a general prohibition on processing such data. Processing is only permitted where a statutory exception applies and the other data protection requirements are met.

Which types of data fall within the special categories of personal data?

Article 9(1) GDPR specifies which personal data are subject to special protection.

These include:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data for the purpose of uniquely identifying a natural person
• Data concerning health
• Data concerning a person's sex life or sexual orientation

The need for special protection arises because unlawful processing of this data may have significant consequences for the privacy and fundamental rights of data subjects.

Not every confidential piece of information automatically falls within the special categories under Article 9 GDPR. For example, bank details and income information are generally not special categories of personal data, even though they may also require protection.

Under what conditions may special categories of personal data be processed?

Under Article 9(1) GDPR, the processing of special categories of personal data is generally prohibited.

However, Article 9(2) GDPR provides for exceptions under which processing may be permitted.

These include, in particular:

• Explicit consent: The data subject has given explicit consent to the processing for one or more specified purposes.
• Employment and social security law: Processing is necessary, subject to the statutory conditions, for the purposes of carrying out obligations or exercising specific rights in the field of employment law, social security or social protection.
• Vital interests: Processing is necessary to protect vital interests, and the data subject is physically or legally incapable of giving consent.
• Legal claims: Processing is necessary for the establishment, exercise or defence of legal claims or in the course of judicial activities.
• Healthcare: Processing is necessary, subject to the statutory conditions, in particular for medical diagnosis, treatment or the management of healthcare systems.
• Substantial public interest: A legal basis permits the processing, subject to the required safeguards.

Further exceptions apply, for example, to certain activities of non-profit organisations, data manifestly made public by the data subject, and research and statistical purposes regulated by law.

In addition to an exception under Article 9(2) GDPR, an appropriate legal basis under Article 6(1) GDPR must generally also exist.

An exception under Article 9 GDPR alone is therefore not sufficient in every case to justify the processing of personal data.

What specific data protection requirements must companies observe?

When processing special categories of personal data, companies must comply both with the general requirements of the GDPR and with the additional conditions set out in Article 9 GDPR.

Under Article 5 GDPR, the principles of purpose limitation, data minimisation, storage limitation, and integrity and confidentiality apply in particular.

In addition, under Article 32 GDPR, controllers must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These may include, in particular:

• Restricting access to data to authorised persons
• Encrypting particularly sensitive information
• Establishing appropriate retention and erasure periods
• Logging and monitoring access to data
• Regularly reviewing the security measures implemented
• Training employees in the handling of sensitive personal data

The measures required depend on the specific risks associated with the processing concerned.

A data protection impact assessment may also be required under Article 35 GDPR. This applies in particular to large-scale processing of special categories of personal data where the statutory conditions are met.

Companies should therefore assess, before commencing processing, which safeguards are required and whether any additional statutory obligations apply.

What special rules apply to health data and employee data?

Under Article 9(1) GDPR, health data are among the special categories of personal data that receive enhanced protection.

Examples include medical findings, diagnoses, examination results and other information that may reveal a person's state of health.

The exceptions under Article 9(2)(h) GDPR concerning the provision of healthcare may be particularly relevant to the processing of such data. The requirements of Article 9(3) GDPR must also be observed, particularly those relating to professional secrecy.

Companies may also process special categories of personal data in the employment context under certain circumstances.

Examples include health information relating to incapacity for work or information about trade union membership.

Article 9(2)(b) GDPR and supplementary national provisions may be particularly relevant to the processing of such data. In the context of German employee data protection law, Section 26(3) of the German Federal Data Protection Act (BDSG) may also apply. Its applicability must be assessed in light of EU law requirements and the case law of the Court of Justice of the European Union.

However, processing is not permissible merely because the data are of interest to the employer.

Companies must instead assess whether the processing is necessary for a legally permissible purpose and whether the relevant statutory requirements are met.

What are the consequences of unlawfully processing special categories of personal data?

If special categories of personal data are processed without an adequate legal basis or in breach of the GDPR requirements, various legal consequences may arise.

Under Article 58 GDPR, data protection supervisory authorities may, in particular, conduct investigations, order the restriction or cessation of processing and impose administrative fines subject to the statutory conditions.

Article 83(5) GDPR provides for an increased maximum fine for infringements of the fundamental processing requirements under Articles 5, 6 and 9 GDPR.

The maximum fine is up to EUR 20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

The actual amount of a fine depends on the circumstances of the individual case.

In addition, under the conditions set out in Article 82 GDPR, data subjects may claim compensation if they have suffered material or non-material damage as a result of an infringement of the GDPR.

Not every data protection infringement automatically results in a fine or a right to compensation.

Practical example: Processing health data in a company

A company employs several people and receives information about their incapacity for work in connection with sickness-related absences.

The HR department requires certain information to assess entitlement to continued remuneration and fulfil statutory obligations.

As information about incapacity for work may reveal a person's state of health, it constitutes specially protected personal data.

The company must therefore assess the legal basis on which the necessary information may be processed and which exception under Article 9(2) GDPR applies.

As a general rule, only health information necessary for the relevant lawful purpose may be processed.

The blanket collection of medical diagnoses is generally not necessary for the routine administration of periods of incapacity for work.

The company must also ensure that access to the relevant information is restricted to authorised persons.

legal data assessment: When processing special categories of personal data, companies should carefully assess which information is actually required and which legal provisions can serve as the basis for the processing. In addition to complying with the requirements of Article 9 GDPR, clearly defined access permissions, appropriate security measures and transparent internal procedures are particularly important. An early data protection assessment helps prevent unlawful processing and reduce the associated legal risks.

Legal basis

Articles 4(13)–(15), 5, 6, 9, 32, 35, 58, 82 and 83 GDPR; in addition, in particular, Section 22 BDSG and Section 26(3) BDSG, insofar as the latter applies and the respective statutory conditions are met.