Understanding Article 9 of GDPR
Article 9 of GDPR outlines the different categories of special personal data requiring further protection under the law and even prohibited.
Prohibition of processing special categories of personal data (Article 9(1) GDPR)
GDPR specifically names different categories of personal data that are quite important to individuals and therefore the processing should be prohibited.
These categories are:
- Racial data
- Ethnic origin
- Political opinions
- Religious beliefs
- Philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data for identifying a person
- Health data
- Data on a person’s sex life
- Data on a person’s sexual orientation
Exceptions to the prohibition (Article 9(2) GDPR)
In certain cases, the processing of the special categories of data can be possible when:
- The data subject has given explicit consent (Article 9(2)(a) GDPR)
- The processing is necessary to carry out an obligation and exercise a right in the field of employment, social security, social protection or collective agreement regarding a fundamental right (Article 9(2)(b) GDPR)
- For the vital interest of the data subject or a person not capable of giving consent (Article 9(2)(c) GDPR)
- For a legitimate activity with appropriate safeguards by a foundation, association or not-for-profit organization (Article 9(2)(d) GDPR)
- If the data is made public by the data subject (Article 9(2)(e) GDPR)
- When the processing is necessary to exercise a legal claim or defence (Article 9(2)(f) GDPR)
- When it’s necessary for the public interest (Article 9(2)(g) GDPR)
- For the rendering of health or social care services (Article 9(2)(h) GDPR)
- When it’s necessary for the public interest in the area of health to prevent cross-border threats to health(Article 9(2)(i) GDPR)
- When it’s necessary for archiving, scientific or historical research purposes in the public interest (Article 9(2)(j) GDPR)
Processing for health and social care purposes (Article 9(3) GDPR)
A special category of data can be processed for health and social care purposes provided that the data is processed by a professional bound by a professional code and obligations of confidentiality or secrecy.
Member states to introduce further conditions (Article 9(4) GDPR)
As it relates to the processing of personal data under a special category, each European Union member state can introduce legislation to further restrict or limit the processing of genetic, biometric data or data concerning the health of a data subject.
Recitals applicable to Article 9 of GDPR
Relevant Recitals: 46, 51, 52, 53, 54, 55, 56
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 9 or relevant recitals
GDPR Text: Article 9 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection Regulation
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)