1. Skip to content

We use cookies to improve your online experience. For information on the cookies we use and for details on how we process your personal information, please see our privacy policy. By continuing to use our website you consent to us using cookies. OK, Thanks

WHEN CAN I PROCESS "SENSITIVE PERSONAL DATA" (special category data)?

Sensitive personal data, which the GDPR refers to as 'special category data', means informatoin about a person's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, and sexual life. The GDPR adds the following new additional categories: genetic data, biometric data and sexual orientation. To process sensitive personal data one of the following should apply - however please note that:

(a) More than one of the criteria below can apply at the same time.

(b) Data controllers need to establish a lawful basis for processing any personal data (see previous paragraph Lawful basis for processing)and, if they are processing sensitive personal data they must also establish that at least one of the criteria below applies:

(i) Explicit consent of the data subject has been obtained (which can be withdrawn).

(ii) Employment Law – if necessary for employment law or social security or social protection.

(iii) Vital Interests – e.g. in a life or death situation where the data subject is incapable of giving consent.

(iv) Charities, religious organisations and not for profit organisations – to further the interests of the organisation on behalf of members, former members or persons with whom it has regular contact such as donors. Please note councils and parish meetings cannot rely on (iv) as a lawful basis for processing personal sensitive data.

(v) Data made public by the data subject – the data must have been made public 'manifestly'.

(vi) Legal Claims – where necessary for the establishment, exercise or defence of legal claims or for the courts acting in this judicial capacity.

(vii) Reasons of substantial public interest – where proportionate to the aim pursued and the rights of individuals are protected.

(viii) Medical Diagnosis or treatment – where necessary for medical treatment by health professionals including assessing work capacity or the management of health or social care systems.

(ix) Public Health – where necessary for reasons of public health e.g. safety of medical products.

(x) Historical, Statistical or scientific purposes – where necessary for statistical purposes in the public interest for historical, scientific research or statistical purposes.