This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
In the General Data Protection Regulation (GDPR), the legislator distinguishes between personal data and special categories of personal data. What are special categories of personal data under the GDPR?
What are special categories of personal data?
They are sensitive data, such as information about a person’s religion, race, health or criminal record. The GDPR offers a high level of protection for the processing of these categories of personal data.
The GDPR has changed the wording of the special categories of personal data. For example, genetic data are explicitly designated as special categories of personal data in the GDPR. The sensitivity of genetic data, such as DNA, stems from the fact that they reveal something about the state of health of a person and their relatives.
Biometric data as special categories of data
Biometric data are also designated as special categories of personal data under the GDPR. However, this requires that they are processed for the purpose of uniquely identifying a person. Examples of biometric data include fingerprints, voice, handwriting and scans of the retina, iris and face. These exact measurements contain a person’s unique physical characteristics. This is what makes these biometric data special in nature.
Why is there a distinction between personal data and special categories of personal data?
Processing special categories of personal data is prohibited, unless an organisation can rely on a specific statutory exception. For example, the explicit consent of the data subject can be regarded as an exception to this prohibition. It is important that the consent is verifiable. This consent may be withdrawn at any time. This ensures that the data subject can be certain that they can decide on the personal data relating to them.
What does this mean for my organisation?
The processing of these data is subject to statutory rules aimed at the lawful processing of personal data. This entails additional responsibilities for organisations. As an organisation, you must therefore have insight into which data you process and whether you process special categories of personal data. You must then check whether you process these data securely. You must also check whether you share these personal data with third parties.
In some cases, you may simply process these personal data. Consider, for example, the situation where you are a physiotherapist and need information from your client about their health in order to apply the right treatment. Or consider the situation where you are the employer and need to keep track of whether the employee has called in sick. In that case, you may not ask substantive questions about the background of the sickness report; for that, you need the company doctor or occupational health physician. More on this in another article.