Data Concerning Health (Article 4(15) GDPR)

Data concerning health is personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status (Article 4(15) GDPR). The term is defined broadly: it covers information on a person's past, current or future state of health (Recital 35 GDPR).

1. Overview

Data concerning health forms a subcategory of personal data and is at the same time among the information especially worthy of protection that Article 9 GDPR subjects to a stricter regime. The Union legislature has given the term an autonomous definition in Article 4(15) GDPR, which is substantially specified by Recital 35 GDPR.

The essential feature is the twofold connection: the datum must relate to the health of a natural person and it must reveal information about their state of health. This covers not only classic medical records but all data from which something about a person's physical or psychological condition can be derived, whether directly or indirectly.

2. Scope of the Definition

2.1 Material Scope

Recital 35 GDPR lists, by way of example, which information falls under the term:

The origin of the data is irrelevant: whether it comes from a physician, a hospital, a medical device, or a fitness app makes no difference to its classification as data concerning health.

2.2 Temporal Dimension

The term is not limited to present health information. It equally covers data about a past state of health (e.g. earlier illnesses, completed treatments) and information about future health risks (e.g. genetically determined probabilities of disease, predictive findings).

2.3 Broad Interpretation in Practice

The CJEU has consistently interpreted the term broadly. According to this case law, even ordering pharmacy-only, non-prescription medicinal products in an online shop generates data concerning health, because the products ordered allow inferences to be drawn about the buyer's state of health (CJEU, judgment of 4 October 2024, C-21/23, Lindenapotheke). Not every mere possibility of a connection to health suffices; there must be a sufficiently concrete informational content regarding the state of health.

Data collected about users on social media platforms can also constitute data concerning health where health-related inferences can be drawn from it. In this context, the CJEU has clarified that the operator of a social network may not process such data merely because the data subject has expressed corresponding information in a public context (CJEU, judgment of 4 October 2024, C-446/21, Schrems/Meta).

3. Classification Within the GDPR Framework

Data concerning health is one of the special categories of personal data exhaustively enumerated in Article 9(1) GDPR. A general prohibition of processing applies to it; processing is permitted only where one of the exceptions in Article 9(2) GDPR applies. Of particular relevance in the health context are:

• the explicit consent of the data subject (Article 9(2)(a) GDPR),
• processing to protect vital interests (Article 9(2)(c) GDPR),
• processing by health professionals (Article 9(2)(h) GDPR), and
• reasons of public interest in the area of public health (Article 9(2)(i) GDPR).

In addition, Article 9(4) GDPR gives Member States the option to lay down further conditions for data concerning health, which in Germany is done above all through sector-specific rules in the German Social Code (Sozialgesetzbuch) and other specialized statutes.

Further details on the grounds for permissibility can be found in the overview of the special categories of personal data.