Special Categories of Personal Data (Article 9 GDPR)

Article 9 GDPR establishes a general prohibition of processing for certain categories of data that are particularly sensitive from a fundamental rights perspective (Article 9(1) GDPR) and lifts that prohibition only for an exhaustive catalog of grounds for lawful processing (Article 9(2) and (3) GDPR). In addition, Article 9(4) GDPR opens the way for national law to impose further requirements with regard to genetic data, biometric data and data concerning health.

1 Overview and classification

1.1 Subject matter of the provision

Article 9(1) GDPR names nine categories of personal data whose processing is generally prohibited:

• data revealing racial or ethnic origin,
• data revealing political opinions,
• data revealing religious or philosophical beliefs,
• data revealing trade union membership,
• genetic data (Article 4(13) GDPR),
• biometric data for the purpose of uniquely identifying a natural person (Article 4(14) GDPR),
• data concerning health (Article 4(15) GDPR),
• data concerning sex life and
• data concerning sexual orientation.

The background to this heightened protective regime is the generalized assumption that the processing of these categories is capable of endangering the fundamental rights and freedoms of the data subject in a particular way (Recital 51 GDPR). The Union legislature itself designates this category as "sensitive data" (Recital 10, fifth sentence, GDPR); the commentary literature uses that designation interchangeably with "special category data".

The protective rationale draws on three sources, which carry different weight from case to case:

• Informational prohibition of discrimination: most of the categories carry an increased risk of discrimination (Article 21 of the EU Charter of Fundamental Rights (CFR), Article 14 of the European Convention on Human Rights (ECHR)). An infringement of Article 9 GDPR is at the same time an indication of discrimination within the meaning of anti-discrimination law and may give rise to claims under the German General Equal Treatment Act (AGG).
• Protection of highly personal attributes: the data listed are constitutive of the data subjects' identity; their corruption or misuse carries a considerable potential for harm, both individually and at group level.
• Protection in situations of distress: where health data, social data and similarly burdensome data are concerned, data subjects should be able to seek professional help without fear and to disclose themselves for that purpose. This strand connects Article 9 GDPR with the protection of professional secrecy (Article 90 GDPR, § 203 of the German Criminal Code (StGB)).

Deliberately not included in the catalog, by contrast, are types of data that may be comparably sensitive in practice, such as location data, financial transaction data, information on poverty, age (§§ 8-10 AGG), gender or wealth (Article 21(1) CFR). The classification under Article 9 GDPR remains a generalization: it is an indication, not proof, that protection is required in the individual case; conversely, types of data that are not listed are likewise protected through the general principles (in particular Articles 5 and 6 GDPR).

Details on the catalog and on the individual categories can be found under Sensitive categories of data (Article 9(1) GDPR).

1.2 Legal consequence of paragraph 1

The legal consequence is a general prohibition of processing. Processing without an applicable ground for lawful processing is unlawful and triggers the fine regime of Article 83(5)(a) GDPR (up to EUR 20 million or 4 percent of total worldwide annual turnover). The category of the personal data processed must moreover be taken into account when determining the amount of an administrative fine (Article 83(2)(g) GDPR).

The prohibition applies irrespective of whether the controller acts in a private capacity or as a body exercising public authority, and it is tied to an objective standard: any intention to evaluate the data is relevant at most for establishing the context, not as an independent element of the provision.

1.3 Relationship to Article 6 GDPR

Article 9 GDPR does not displace Article 6 GDPR but is superimposed on it (Recital 51, fifth sentence, GDPR; CJEU, judgment of 4 July 2023, C-252/21, Meta Platforms v Bundeskartellamt, paras. 71 et seq.). Anyone seeking to process sensitive data must satisfy both layers of lawfulness cumulatively:

Conversely, Article 9 GDPR has a preclusive effect wherever no exception applies: recourse to the general grounds for lawful processing in Article 6 GDPR is then ruled out (CJEU, judgment of 4 July 2023, C-252/21, Meta Platforms v Bundeskartellamt, para. 89).

1.4 Knock-on effects within the GDPR

Classifying data as a special category has consequences at numerous further points in the GDPR:

• the compatibility test where purposes are changed (Article 6(4)(c) GDPR),
• additional requirements for automated individual decision-making (Article 22(4) GDPR),
• the obligation to designate a representative even for processing that would otherwise be exempt (Article 27(1)(a) GDPR),
• the documentation obligation in the records of processing activities despite the de minimis thresholds (Article 30(5) GDPR),
• the obligation to carry out a data protection impact assessment in the case of processing on a large scale (Article 35(3)(b) GDPR),
• the obligation to designate a data protection officer where such processing is a core activity (Article 37(1)(c) GDPR).

Anyone handling sensitive data is therefore caught not only by the prohibition regime of Article 9 GDPR but by an entire bundle of additional obligations.

2 Structure of the grounds for lawful processing

Article 9(2) GDPR contains an exhaustive catalog of ten exceptions (points (a) to (j)); Article 9(3) GDPR supplements it with personal requirements for the professionals acting in the health sector. There is no general contractual ground parallel to Article 6(1)(b) GDPR: anyone processing sensitive data within a private law relationship regularly has to rely on explicit consent (point (a)) or on one of the sectoral grounds (point (h)).

The catalog can be divided into two types of grounds for lawful processing:

• Directly applicable grounds (points (a), (c), (d), (e), (f)): they require no further specification by Union or Member State law and apply directly on the basis of the GDPR.
• Opening clauses requiring specification (points (b), (g), (h), (i), (j)): they call for supplementary provisions containing "appropriate safeguards" or "suitable and specific measures". In Germany, this function is performed above all by § 22 BDSG; alongside it stand sector-specific special statutes.

2.1 Categories of grounds for lawful processing

The grounds can be divided broadly into four groups:

• Autonomy-based: explicit consent (point (a)), data manifestly made public (point (e)).
• Protection of overriding interests: vital interests (point (c)), the establishment of legal claims and the judicial capacity of courts (point (f)).
• Sector-specific: employment law and social security law (point (b)), individual health care (point (h) in conjunction with Article 9(3)), public health (point (i)), research, statistics and archiving purposes (point (j)).
• Ideologically oriented or grounded in public law: activities of not-for-profit bodies (point (d)), substantial public interest (point (g)).

For a detailed account of the individual grounds: Grounds for lawful processing (Article 9(2) and (3) GDPR).

2.2 Appropriate safeguards and specific measures

Several grounds (points (b), (g), (h), (i), (j)) require the relevant Union or Member State law to provide for "appropriate safeguards" or "suitable and specific measures" to safeguard the fundamental rights and the interests of the data subject. Examples are professional secrecy obligations, encryption, pseudonymization, access restrictions and organizational separation. In Germany, § 22(2) BDSG gives concrete shape to these measures by way of standard examples.

2.3 Opening clauses for national law

The grounds in Article 9(2)(b), (g), (h), (i) and (j) each contain opening clauses of their own. Article 9(4) GDPR additionally permits, in general terms, further conditions or limitations to be introduced with regard to genetic data, biometric data and data concerning health. Details: Opening clause for Member State law (Article 9(4) GDPR).

3 Relationship to adjacent provisions

3.1 Article 10 GDPR (data relating to criminal offenses)

Data relating to criminal convictions and offenses fall outside the catalog of Article 9 GDPR but are subject to their own, likewise heightened, protective regime under Article 10 GDPR. The two provisions are structurally related but not interchangeable.

3.2 Directive (EU) 2016/680

Processing by competent authorities for law enforcement purposes is governed not by Article 9 GDPR but by Article 10 of Directive (EU) 2016/680 (the Law Enforcement Directive) and by the relevant Member State implementing law (§§ 45 et seq. BDSG).

3.3 Change of purpose (Article 6(4) GDPR)

Further processing of sensitive data for changed purposes is not ruled out by Article 9 GDPR alone. It is possible where the changed purpose is compatible with the original purpose (Article 6(4) GDPR) and, in addition, an exception under Article 9(2) or (3) GDPR applies. The German legislature has recorded this requirement by way of clarification in § 23(2) BDSG.

3.4 Archiving, research and statistics privilege (Article 89 GDPR)

Sensitive data too fall within the privilege under Article 5(1)(b), second half-sentence, in conjunction with Article 89 GDPR, whereby the requirements of the Member State implementing law (for Germany, §§ 27 and 28 BDSG) must be complied with.

4 Practical assessment framework