Grounds for Lawful Processing (Article 9(2) and (3) GDPR)

The prohibition on processing sensitive data laid down in Article 9(1) GDPR is qualified by an exhaustive catalog of grounds for lawful processing. Article 9(2) GDPR contains ten exceptions (points (a) to (j)); Article 9(3) GDPR supplements the health care context with requirements as to the persons involved. A general contractual clause is deliberately absent: anyone processing sensitive data in a private law setting will regularly have to rely on explicit consent or on a sector-specific ground.

1 General

1.1 Exhaustive Character and the Rule/Exception Relationship

The catalog is exhaustive; an analogy to Article 6(1)(b) GDPR for contractual processing is not possible. This does not mean, however, that the grounds set out in paragraph 2 are generally to be interpreted restrictively. Their regulatory objectives are too multi-layered to be forced into a rigid rule/exception scheme. The appropriate direction of interpretation in each case follows from the telos of the individual ground and from the interest it protects.

Within the catalog, two types of grounds must be distinguished:

• Directly applicable grounds (points (a), (c), (d), (e), (f)): they take effect directly on the basis of the GDPR. National specification is possible, but not required.
• Opening clauses requiring further specification (points (b), (g), (h), (i), (j)): they mandatorily require supplementary provisions in Union or Member State law which provide for "appropriate safeguards" or "suitable and specific measures" to protect the rights of data subjects. In Germany, these are above all § 22 BDSG and the sector-specific special statutes (Genetic Diagnostics Act (GenDG), Social Code (SGB), Infection Protection Act (IfSG), Transplantation Act (TPG), Medicinal Products Act (AMG), Identity Card Act (PAuswG)).

In an individual case, several grounds may exist alongside one another; each pursues its own objective, and they do not automatically stand in a relationship of speciality. If a consent proves to be invalid, recourse to a statutory basis is in principle possible, but this presupposes that transparency under Article 14(1)(c) GDPR is established at the same time and that fairness is preserved.

1.2 Cumulative Assessment Together with Article 6 GDPR

An exception under Article 9(2) GDPR does not replace the legal basis under Article 6 GDPR. Both layers are always required (CJEU, judgment of 4 July 2023, C-252/21, Meta Platforms/Bundeskartellamt, paras. 71 et seq.). If no exception applies, Article 9 GDPR has a blocking effect; recourse to Article 6 GDPR is excluded.

1.3 Union Law, Member State Law and Safeguards

Several grounds refer to implementing Union or Member State law (points (b), (g), (h), (i), (j)) and require "appropriate safeguards" or "suitable and specific measures" to safeguard the fundamental rights and the interests of the data subject. Implementation by the legislature is to be understood as a two-stage process:

1. The legislature provides an abstract and general framework, for example through § 22 BDSG, § 26 BDSG, the Genetic Diagnostics Act (GenDG) or sector-specific social and health statutes.
2. The controller gives concrete form to the measures in the individual case, in so far as the applicable law is framed flexibly.

Typical safeguards are professional secrecy obligations, encryption, pseudonymization, restrictions on access and on the storage location, integrity codes, and an enhancement of data subject rights (EDPB, Guidelines 3/2019 on processing of personal data through video devices, version 2.0, 29 January 2020, paras. 87 et seq.).

2 The Individual Grounds

The following overview assigns each of the ten grounds to its respective type; the detailed treatment follows in sections 2.1 to 2.10.

2.1 Explicit Consent (Article 9(2)(a))

Consent under Article 9(2)(a) GDPR tightens the general consent requirement of Article 6(1)(a) GDPR in three respects:

• Explicitness: implied or tacit approval is not sufficient. Pre-ticked boxes, inactivity or silence do not qualify as consent (Recital 32, third sentence, GDPR; CJEU, judgment of 1 October 2019, C-673/17, Planet49, paras. 60 et seq.).
• Link to a purpose: consent must relate to one or more specified purposes; blanket consent fails the requirement of specificity.
• Form and proof: the GDPR does not prescribe any particular form. The accountability obligation (Article 5(2), Article 7(1) GDPR) does, however, regularly give rise to the need for a documented declaration (in writing, electronically signed, in a two-step procedure with a confirmation link, or by completing an electronic form).

Typical constellations of imbalance in which it must be examined with particular care whether consent is freely given: insurance contracts, landlord-tenant relationships, the relationship between physician and patient, as well as other assistance relationships. It follows from Recital 43 GDPR that, where there is a clear imbalance, consent should not provide a valid legal basis. A blanket denial that consent is freely given in such relationships is nevertheless not called for. Suitable options to choose from, an express indication that consent is voluntary, and assurance that a refusal will not entail any disadvantages can compensate for a lack of free choice. In emergency situations, a heightened examination of whether consent is freely given is called for.

Distinction from a release from professional confidentiality. Consent under data protection law is not identical to a release from a professional duty of confidentiality. Because of the two-barrier principle, two declarations may be necessary for the processing of sensitive data and for the disclosure of a professional secret, each of which must meet its own requirements. A single declaration is possible; in that case the requirements of both regimes must be met cumulatively. Under professional conduct rules, an implied declaration has traditionally been accepted for a release from the duty of confidentiality; by contrast, consent under data protection law pursuant to Article 9(2)(a) GDPR must be given explicitly; implied consent is not sufficient.

Broad consent and other models. In medical or genetic research, an appropriately designed "broad consent" is permissible. The German Data Protection Conference (DSK) accepted this in its decision of 15 April 2020 for the processing of data concerning health for research purposes, subject to compensating safeguards under Article 89(2) GDPR. The basis lies in the freedom of research (Article 13 of the Charter of Fundamental Rights of the European Union, the Charter; Article 5(3) of the German Basic Law (GG)) and in the privileged treatment of the purpose under Article 5(1)(b) GDPR (Recital 33 GDPR). Modern models (dynamic consent, tiered consent, cascading consent) may serve the interests at stake better, depending on the project.

Exclusion of consent. Article 9(2)(a), second half-sentence, GDPR gives Union or Member State law the option of excluding consent entirely as a route to lawfulness. This is justified where free choice is structurally doubtful (e.g. strong relationships of dependency). Of practical significance is § 8(1) of the German General Equal Treatment Act (AGG): under that provision, consent to the processing of data revealing racial and ethnic origin, political opinions, religious, philosophical and political beliefs, as well as trade union membership, is largely excluded in the employment relationship. As a "lesser" measure, the legislature may also tighten the requirements for consent instead of excluding it. Example: § 8(1) GenDG for genetic testing.

Employment context. For sensitive employee data, consent is possible under § 26(2) BDSG; heightened requirements apply as to whether it is freely given.

2.2 Employment and Social Security Law (Article 9(2)(b))

Point (b) legitimizes the processing of sensitive data in so far as it is necessary for carrying out obligations and exercising rights arising from employment law, social security law or social protection law. This requires a basis in Union or Member State law, including collective agreements, works agreements and collective bargaining agreements (Recital 52 GDPR).

Typical applications:

• recording of days of sickness, severe disabilities and employment bans,
• biometric access controls to security-sensitive areas as well as biometric time recording (strict necessity and proportionate design must be observed),
• information on religious affiliation for church tax purposes,
• information on trade union membership for payroll purposes or for work on the works council,
• provision and settlement of social benefits (SGB, Books I, V, VI, VII, XI, XII; educational support).

Because of the exceptional character of the provision, the standard of necessity is to be interpreted narrowly. Political opinions are regularly not necessary for employment law purposes, not even in ideological organizations, unless the expression of opinion relates to the professional position. Genetic data may be processed in working life only to a very limited extent; in certain narrow areas of occupational medicine, genetic health analyses may be proportionate (see §§ 19-22 GenDG). Data concerning sex life may regularly not be used; exceptions exist in so far as sexuality forms part of the professional activity.

Distinction from point (h). Processing for purposes of occupational medicine and for the assessment of working capacity falls not only under point (h) but is also covered by point (b); both grounds apply alongside one another.

Social law. Point (b) additionally legitimizes the processing of sensitive data provided for in the books of the Social Code for the provision of social benefits: from occupational health and safety, through educational and vocational training support, insurance benefits in cases of sickness, long-term care, accident and old age, and family and youth welfare, to support for the participation of persons with disabilities. The legitimation supports only the purposes provided for by law; processing by the employer for its own purposes outside that framework is not covered by it.

In Germany, § 22(1) no. 1(a) BDSG implements the ground verbatim for non-public and public bodies; § 22(2) BDSG sets out the required safeguards by way of standard examples.

2.3 Vital Interests (Article 9(2)(c))

Point (c) permits processing to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. It is to be understood as an ultima ratio (Recital 46 GDPR).

2.4 Not-for-Profit Bodies with an Ideological Aim (Article 9(2)(d))

Point (d) privileges foundations, associations or any other not-for-profit bodies with a political, philosophical, religious or trade union aim. Requirements:

• the body has a political, philosophical, religious or trade union aim and does not pursue profit; its legal form is irrelevant.
• processing in the course of the body's legitimate activities, limited to the respective "aim" (a church may therefore not process political data by relying on point (d)).
• limitation to members, former members, or persons who have regular contact with the body in connection with its purposes ("close and constant").
• no external disclosure without the consent of the data subject.

For external disclosures, lawfulness is therefore governed by point (a). Purely charitable organizations (NGOs) that cannot be assigned to any of the four aims mentioned do not fall under point (d).

Classification of typical organizations. Privileged are political parties including their youth and sub-organizations and party-affiliated foundations, churches and their not-for-profit social associations, free religious communities, as well as trade unions (the German Trade Union Confederation (DGB), individual trade unions, union-affiliated foundations). Professional associations that represent the economic, social and political interests of their members are covered; chambers organized as public law corporations, by contrast, are not. Staff councils and works councils do not enjoy the privilege because they lack full legal autonomy. A dual aim is possible (e.g. Christian trade unions). Diakonie and Caritas are privileged; predominantly commercially oriented organizations such as Scientology do not fall within the provision. Commercial companies and general NGOs without a relevant aim are excluded.

Profit-making intent. A commercial activity that benefits the purpose of the body is permissible; the boundary must be drawn in the individual case. The privilege does not apply to commercial undertakings owned by an ideological organization.

Internal processing. The privilege covers exclusively internal data processing. Point (a) applies to direct marketing, advertising or publications on the internet. Within the limits of what is necessary, data processing between hierarchically or organizationally linked entities is also privileged (federal, state and regional level of a political party; church associations; umbrella organizations of trade unions).

Processing on behalf of a controller. Outsourcing under Article 28 GDPR is permissible, but the privilege does not extend to the processor. The processor must have its own legal basis; the limitation of the purpose to the body's aim must be secured contractually.

Safeguards. The legal basis in the statutes, in church law or in another rule must provide for appropriate safeguards: strict purpose limitation, separation of data, specific complaint mechanisms. If the safeguards are missing, the processing is unlawful even within an ideological organization.

2.5 Data Manifestly Made Public (Article 9(2)(e))

Point (e) permits the processing of sensitive data where the data have been "manifestly made public" by the data subject. The ground is to be interpreted restrictively (CJEU, judgment of 4 July 2023, C-252/21, Meta Platforms/Bundeskartellamt, para. 76; CJEU, judgment of 4 October 2024, C-446/21, Schrems/Meta, para. 77).

The public. Closed groups, classrooms, delimited discussion spaces, or social networks with a limited circle of addressees do not constitute "the public" within the meaning of the provision. Posts in social media groups likewise do not automatically have the effect of a public announcement; the participants regularly assume a "contextual integrity".

Manifestness. What is required is a making public that is clearly attributable to an act of will of the data subject. The CJEU requires an explicit and clearly affirmative act by which the person intends to make the data accessible to the general public.

No submission by mere presence. Mere presence in a public space or participation in a demonstration or an event is not sufficient to assume a making public. Statements made in public that are not addressed to the public are likewise not manifestly made public. Press reports produce the effect of point (e) only where the information is recognizably attributable to the data subject (e.g. through authorized quotations).

Re-publication and profiling. Where data published by the data subject are re-published by third parties, the controller may in principle rely on the initial publication. That falls away, however, where the data have been subjected to a complex analysis (in particular to profiling within the meaning of Article 4(4) GDPR) prior to the re-publication. Mere toleration of the publication by the data subject is likewise not sufficient.

Accessibility via search engines does not in itself constitute manifestness (cf. the line taken by the CJEU in judgment of 13 May 2014, C-131/12, Google Spain).

2.6 Legal Claims and Judicial Activity (Article 9(2)(f))

Point (f) permits processing for the establishment, exercise or defense of legal claims, or whenever courts are acting in their judicial capacity. The concept of "legal claims" is autonomous under Union law and is to be understood broadly; it covers civil law and public law positions, as well as claims in administrative and out-of-court proceedings (Recital 52, third sentence, GDPR).

Scope of the concept of a claim. "Legal claims" is an autonomous concept of Union law and is to be understood broadly: civil law, public law and procedural positions are covered, including in criminal proceedings (§§ 394 et seq., 403 et seq. of the German Code of Criminal Procedure (StPO)). Claims may arise from statute, from contract, from a quasi-contractual obligation, or from harmful conduct. In the case of insurance contracts with protective effect for third parties, point (f) also extends to the data of those third parties. A mere legal relationship is not sufficient; what is required is a concrete conflict that compels the holder of the claim to take procedural action. The claim must be determined in terms of its content and of the parties involved. Pendency of proceedings is not required; out-of-court proceedings are also covered. It is irrelevant whether the controller is the creditor or the debtor.

Necessity. Point (f) does not provide for a balancing against the concerns of the data subject; all the more precisely, therefore, must necessity be examined. The decisive assessment is made ex ante; a subsequent divergent court decision does not change this. In the case of disputed claims, the requirements as to necessity must not be overstretched; it must be possible to adduce evidence even where its value is initially unclear. What is required is a plausible justification of the evidential relevance in relation to the subject matter of the dispute. The limit is arbitrary submissions that do not objectively belong to the subject matter of the dispute. In case of doubt, a balancing of interests must be carried out; where the interests of the data subject meriting protection prevail, the processing must be refrained from. The interest in pursuing legal claims must actually have arisen at the time of the processing and must not be merely hypothetical (cf. CJEU, judgment of 11 December 2019, C-708/18, Asociaţia de Proprietari).

Attorneys. In the course of handling a mandate, attorneys may process sensitive data, including data of third-party data subjects, and submit them in court, in so far as this is necessary for pursuing the legal claim.

Consequence for the right to erasure. As long as the data are needed for pursuing legal claims, the data subject has no right to erasure (Article 17(3)(e) GDPR).

Judicial acts and publication of judgments. Sensitive data may be recorded in so far as they are indispensable for reaching the decision (e.g. data concerning health when assessing damages for pain and suffering, or personal circumstances when determining the sentence; this becomes relevant, for instance, where in civil proceedings concerning a physician's fee a treatment error is in dispute). When publishing decisions, the available options for anonymization must be exhausted; where appropriate, a distinction must be drawn between the parts that are necessary for understanding and those that are dispensable.

2.7 Substantial Public Interest (Article 9(2)(g))

Point (g) is an opening clause for Union or Member State law that permits the processing of sensitive data for reasons of substantial public interest. The implementing law must be proportionate, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Application proceeds in two stages:

The interest must be of particular importance; general public purposes are not sufficient, and the purposes must be specified in relation to the sensitive data. The burden of demonstrating the substantial public interest lies with the controller. The legislature giving concrete form to the provision nevertheless retains a wide margin of discretion.

Essence of the right. The implementing law must respect the essence of the fundamental right to data protection (Article 52(1) of the Charter, Article 19(2) GG). Suspicionless surveillance and blanket restrictions of data subject rights are incompatible with this. That line has been settled CJEU case law since Digital Rights Ireland.

The CJEU has also applied point (g) to search engine operators, which, when dealing with de-listing requests, must assess the linking of sensitive data against the freedom of information (Article 11 of the Charter) (CJEU, judgment of 24 September 2019, C-136/17, GC and Others/CNIL, paras. 66 et seq.).

2.8 Individual Health Care (Article 9(2)(h) in Conjunction with Article 9(3))

Point (h) covers processing for individual health care: preventive medicine, occupational medicine, the assessment of working capacity, medical diagnosis, the provision of care or treatment, as well as the management of systems and services in the health or social care sector. Privately organized cost-coverage procedures (health insurance billing, supply of therapeutic appliances) are also covered. § 22(1) no. 1(b) BDSG implements the ground for German law.

Medical care. Covered are prevention, diagnosis, treatment and aftercare, including rehabilitation. The processing is initially limited to the respective institution (medical practice, pharmacy, hospital, other health care institutions). In addition to the treatment itself, associated administrative tasks are included: billing, bookkeeping, statistics. The concept of treatment is broad: operations and injections, as well as the administration or prescription of medicinal products and verbal measures, diagnostics and therapy, altruistic measures such as blood donation, and wish-fulfilling medicine. Treatment is regularly accompanied by an individual documentation obligation (§ 630f of the German Civil Code (BGB)).

Management of health care. Covered is the entire organizational framework of health services, in particular the service data under §§ 294 et seq. SGB V, but also privately organized cost-coverage procedures operated by private insurers. The actors included within the German statutory health insurance system are in particular the health insurance funds (§ 284 SGB V), the associations of statutory health insurance (dental) physicians (§ 285 SGB V) and the Medical Service (§ 278 SGB V); covered are organization, planning, billing (§§ 295, 295a, 300 et seq. SGB V), billing and efficiency audits (§§ 106, 106a SGB V), as well as quality assurance (§§ 72(2), 135 et seq., 299 SGB V). Billing may also be outsourced to private service providers (pharmacy accounting centers under § 300 SGB V, family physician associations under § 295a(1) SGB V in conjunction with §§ 73b, 73c, 140a SGB V). In performing these tasks, necessity and data economy must be observed; tasks that go beyond the individual can often be accomplished with pseudonymous or anonymous data.

Occupational medicine maps a triangular relationship between employer, employees and medical staff. In addition to point (h), point (b) is regularly relevant as well. Special legislation: the Occupational Safety Act (ASiG, in particular § 3(1) no. 2 ASiG), SGB V, SGB VII and SGB IX.

Limits. Where a social benefits institution processes data of its own employees under point (h), this must be done by an independent body; a use for the assessment of working capacity is prohibited.

Requirement as to the persons involved. Article 9(3) GDPR restricts point (h): the processing may be carried out only by a professional subject to an obligation of professional secrecy, or by another person also subject to an obligation of secrecy under Union or Member State law. The professional secrecy obligation is thereby at the same time an example of an "appropriate safeguard" within the meaning of points (b) and (i). Subject to an obligation of professional secrecy within the meaning of the provision are, in addition to the classic health professionals (physicians, pharmacists, psychologists), their assistants and participating persons under § 203(3) of the German Criminal Code (StGB), as well as, as an institutional parallel, those bound by the social secrecy obligation under § 35 SGB I, which applies to all social benefits institutions including their auxiliary and technical staff (§ 80 SGB X). For processing by "another person", a comparable level of protection is required.

Distinctions. Point (h) targets the individual interest in functioning care; point (i) serves the genuinely public interest in health; point (j) covers medical research. Overlaps in peripheral areas are harmless. As regards contract-based processing by "health professionals", the relationship to point (a) must be examined carefully.

2.9 Public Health Interests (Article 9(2)(i))

Point (i) is lex specialis in relation to point (g) for processing for reasons of public interest in the area of public health. Examples in the text of the provision: protection against serious cross-border threats to health, ensuring high standards of quality and safety of health care and of medicinal products.

The concept of public health is defined under Union law by Article 3(c) of Regulation (EC) No 1338/2008 (Recital 54 GDPR). Covered are health status (including morbidity and disability), the determinants having an effect on health status, health care needs, the provision of health care services, the financing thereof, and the causes of mortality. The Union's strategic objectives follow from Article 168 of the Treaty on the Functioning of the European Union (TFEU): improving health, protecting against threats to health, and supporting dynamic health systems.

Private controllers. Point (i) is in principle a ground for public bodies. Private undertakings may invoke it only where they perform public health tasks on a statutory basis or act as an entity entrusted with public functions. The processing must not result in third parties (employers, insurance or financial companies) further processing the data for other purposes (Recital 54 GDPR).

Exclusion of erasure. Public health interest purposes may have the consequence that the data subject cannot assert the right to erasure (Article 17(3)(c) GDPR).

National implementing law: § 22(1) no. 1(c) BDSG; sector-specific, the Medicinal Products Act (AMG, in particular §§ 54 et seq. AMG), the Medical Devices Act (MPG, § 26 MPG), the cancer registry acts (Federal Cancer Registry Data Act 2021; clinical cancer registries under § 65c SGB V), the Infection Protection Act (in particular §§ 6 et seq. IfSG), as well as the public health service acts of the German federal states (e.g. the Bavarian Health Service and Consumer Protection Act (BayGDVG)) and the professional codes for the health professions. In the field of tension surrounding quality standards for health care, medicinal products and medical devices: § 5 of the Model Professional Code for Physicians, §§ 72(2), 135 et seq., 299 SGB V, § 11a no. 2 of the German Pharmacies Act (ApoG).

2.10 Research, Statistics and Archiving (Article 9(2)(j))

Point (j) privileges processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes (Article 89(1) GDPR). The provision is likewise lex specialis in relation to point (g). Compared with Directive 95/46/EC (Data Protection Directive), the rules were improved in favor of research: under Article 89(1) GDPR, research purposes are, where sufficient safeguards are in place, deemed "not to be incompatible with the initial purposes"; freedom of research (Article 13 of the Charter, Article 5(3) GG) and data protection thus enter into a relationship of legal parity.

• Archiving purposes. Data are "archived" as soon as they are no longer needed for their original purpose and are retained only for research and documentation purposes (Recital 158 GDPR). "Records of lasting value" within the meaning of the archives acts (the German Federal Archives Act (BArchG), the state archives acts) are the point of reference. The documentation of pending or completed administrative proceedings whose data are still needed for administrative implementation is not archiving within the meaning of point (j); purely private archives are not covered.
• Scientific research. To be understood broadly: fundamental research, applied research, privately funded research, technological development and demonstration (Recital 159 GDPR). The relevant criteria are scientific autonomy, methodology, a systematic approach, the need for proof, verifiability, openness to criticism, and willingness to revise. Clinical trials (AMG) are also covered; research is not excluded by the fact that a project simultaneously serves training or examination purposes.
• Independence. The research privilege applies only to independent research. Commercial market and opinion research is not covered; purely commercially oriented pharmaceutical or biotech research cannot rely on point (j). Third-party funding does not automatically render a project dependent, as long as the formation of findings remains free.
• Statistical purposes. Any processing aimed at statistical results, where the results must be aggregated and without any link to a person (Recital 162 GDPR). Scoring or profiling that leads to individual measures in respect of natural persons does not fall under point (j).

Overlap with points (h) and (i). Where data concerning health are used for research purposes, recourse may be had not only to point (j) but also to point (h) or (i), where the processing serves "health-related purposes" "in the public interest" (Recitals 53, 159 GDPR).

The implementing law must provide for suitable and specific measures. Article 89(1) GDPR requires in particular technical and organizational measures to ensure data minimization; pseudonymization is named as an example. German implementation: §§ 27, 28 BDSG.

2.11 Appropriate Safeguards and Specific Measures

The "appropriate safeguards" expressly required in points (b), (d), (h) and (i) and the "suitable and specific measures" required in points (g), (i) and (j) are relational concepts. Whether they have been complied with depends on the processing context, on the technologies used, and on the specific need for protection.

Examples from the text of the provision, from its interpretation and from practice:

• professional secrecy obligations (expressly in paragraph 3; transferable to other grounds),
• encryption, pseudonymization (by analogy with Article 6(4)(e), Article 89(1) GDPR),
• in the case of biometric data: minimization of the extracted features, careful choice of the storage location, restriction of access to selected staff, separate databases, encryption and key management, integrity codes (signatures, hashes),
• enhancement and extension of data subject rights beyond the basic regime.

§ 22(2) BDSG brings these measures together for German law in a flexible catalog of standard examples.

3 Decision Aid