# Standards and Regulatory References — Special Category Data

## Primary Legislation

### GDPR — Regulation (EU) 2016/679

- **Article 9(1)**: Prohibition on processing special categories of personal data — "Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."
- **Article 9(2)(a)-(j)**: Ten exhaustive conditions for lawful processing of special category data
- **Article 4(13)**: Definition of genetic data — personal data relating to inherited or acquired genetic characteristics giving unique information about physiology or health
- **Article 4(14)**: Definition of biometric data — personal data resulting from specific technical processing of physical, physiological, or behavioural characteristics allowing unique identification
- **Recital 35**: Definition of health data — includes number/symbol assigned for health purposes, information derived from testing/examination, information on disease/disability/risk/history/treatment
- **Recital 51**: Special categories deserve specific protection as the context of their processing could create significant risks to fundamental rights and freedoms
- **Recital 53**: Processing of health data for healthcare purposes where subject to secrecy obligation
- **Article 35(3)(b)**: Mandatory DPIA for processing special category data on a large scale

## Case Law

### Österreichische Post AG — CJEU Case C-300/21 (2023)

- **Court**: Court of Justice of the European Union
- **Holding**: Processing of data that permits an inference about special category information (political affinity scores derived from demographic models) constitutes processing of special category data under Art. 9(1), even when the data was not directly provided by the data subject
- **Significance**: Confirmed that inferred or derived special category data receives the same protection as directly collected data. Controllers cannot circumvent Art. 9 by deriving sensitive attributes from non-sensitive inputs

### Vyriausioji tarnybinės etikos komisija — CJEU Case C-184/20 (2022)

- **Court**: Court of Justice of the European Union (Grand Chamber)
- **Holding**: Publication of a public official's declaration of interests containing the name of their spouse or cohabiting partner constitutes processing of data concerning sex life or sexual orientation within Art. 9(1) when that information permits inference about sexual orientation
- **Significance**: Even indirect revelation of special category data triggers Art. 9 protections

### Swedish DPA — Facial Recognition in Schools (2019)

- **Authority**: Datainspektionen (now IMY)
- **Reference**: DI-2019-2221
- **Decision**: Fined Skellefteå municipality SEK 200,000 for using facial recognition technology for student attendance tracking. The school had obtained parental consent but the DPA found this was not valid explicit consent due to the power imbalance between school and students/parents
- **Significance**: Even with consent, the controller must demonstrate the consent is freely given — Art. 9(2)(a) explicit consent must meet a high threshold, especially with vulnerable data subjects

## Regulatory Guidance

### EDPB Guidelines 05/2022 on the Use of Facial Recognition Technology in the Area of Law Enforcement

- **Adopted**: 12 May 2022 (version 2.0)
- **Key Content**: Detailed analysis of when facial image processing constitutes biometric data processing under Art. 9. Distinguishes between storing photographs (personal data but not special category) and processing photographs for unique identification (special category biometric data)

### Article 29 Working Party — Guidelines on Consent under Regulation 2016/679 (WP259rev.01)

- **Adopted**: 10 April 2018, revised 28 November 2019
- **Key Content**: Section 3.1.1 on explicit consent — explicit consent for Art. 9(2)(a) must be an unambiguous, specific, and express statement of agreement. Explicit consent cannot be obtained through pre-ticked boxes, silence, or inactivity. Recommended methods: written signed statement, filling in an electronic form with affirmative action, oral statement (recorded), two-stage verification

### EDPB Document on Response to COVID-19 (Statement of 19 March 2020)

- **Key Content**: Processing of health data (COVID-19 status, test results, vaccination) in the employment context — employers may process health data under Art. 9(2)(b) (employment law obligation) or Art. 9(2)(i) (public health) where authorised by national law, but must observe data minimisation and purpose limitation

### ICO — Special Category Data Guidance (2024)

- **Reference**: ICO Guide to the UK GDPR, Part 3, Chapter 2
- **Key Content**: Practical guidance on identifying special category data in common business scenarios. Includes worked examples for HR, marketing, financial services, and healthcare contexts