What is special category data?
Special category data is personal data that needs more protection because it is sensitive. The General Data Protection Regulations (GDPR) defines special category data as:
- Personal data revealing racial or ethical origin;
- Personal data revealing political opinions;
- Personal data revealing religious or philosophical beliefs;
- Personal data revealing trade union membership;
- Genetic data;
- Biometric data (used for identification purposes);
- Data concerning health;
- Data concerning a person’s sex life; and
- Data concerning a personal’s sexual orientation.
The above does not include any data relating to criminal allegations, as separate rules apply to this data.
What is the general rule for processing special category data?
Any processing must be lawful, fair and transparent and comply with all of the other principles present in Article 5 of GDPR.
Further, you can only process special category data if you meet one of the conditions under Article 9 of GDPR. If you do not meet one of the specified conditions you cannot lawfully process special category data and you will be in breach of GDPR.
The conditions listed in Article 9 are as follows:
- Explicit consent;
- Employment, social security and social protection;
- Vital interests;
- Not-for-profit bodies;
- Made public by the data subject;
- Legal claims or judicial acts;
- Reasons of substantial public interest;
- Health or social care;
- Public health; and/or
- Archiving, research and statistics.
Most of the above referred to exemptions depend upon you being able to demonstrate that the processing is “necessary” for a specific purpose.
If in fact one of the above referred to exemptions does not apply to the data in question, processing the data in any way would be unlawful and would be in breach of GDPR.
Article 82 of GDPR confirms “any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”
Meaning if you are unlawfully processing special category data, the person to who the data relates could make a claim for compensation.
How can Nelsons help?
Ruby Ashby is an Associate in our expert Dispute Resolution team.
If you require advice in relation to the subjects discussed in this article, please contact Ruby or another member of the team in Derby, Leicester or Nottingham on 0800 024 1976 or via our online form.