The GDPR

Article 9 of the Regulation is based on Article 8 of the Directive, in that it prohibits the processing of sensitive data on the grounds that they deserve specific protection, given the significant risks to the fundamental rights and freedoms inherent in  their processing.

The prohibition covers in general:

- The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership;

- The processing of genetic data and biometric data  in order to identify an individual uniquely ;

- Processing of data concerning health or data concerning sex life or sexual orientation of an individual.

Recital  51  of the Regulations specifies that in case of derogations to the prohibition to process sensitive data, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing.

The concept of "sensitive data" within the meaning of Article 9 of the Regulation has been subject to new developments, given the significant technological developments. So, the prohibition of processing covers, besides the data revealing racial or ethnic origin, political opinions, religion, philosophical beliefs or trade union membership, health or sexual life:

- genetic data: they are defined in Article 4 (13) as personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

- biometric data: they are defined in Article 4 (14) as personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data; .

It should be noted that the data concerning health receive a specific definition in Article 4 (15) as personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

The Regulation includes the exceptions already contained in the Directive by sometimes extending or limiting their scope (explicit consent; employment law and social security law provided that the processing is based on a law of the Union or of a member State or a collective agreement, human life safety, non-profit association, data made public by the data subject, finding, defence, exercise or determination of a legal right, preventive medicine or for substantial reasons of public interest).

The Regulation, however, introduces new derogations:

- for processing necessary for reasons of public interest in the field of public health (see Art. 9,  (2)  i), such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

- for processing necessary for archiving in the public interest or scientific or historical research purposes or statistical purposes  in accordance with Article  89  and based on Union or Member State law (see Art. 9, (2), j)). The final version of the Regulation stipulates that the processing should be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The "sensitive" data referred to in paragraph 1  can be processed for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care within the meaning of Article 9 (2), h), provided that they are processed by or under the responsibility of a professional or by or under the supervision of another person subject to professional secrecy (see Art. 9, (3 )).

Ultimately, the Member States may maintain or introduce more specific provisions; including restrictions regarding genetic, biometric or health-related data (see Article 9 (4)).

The Directive

The first paragraph of article 8 of the Directive provided a general prohibition to process the so-called “sensitive” data, except with data subject’s explicit consent. The paragraph covers the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and of data concerning health or sex life.

The EU legislature had considered that, insofar as these data, by their nature, infringe fundamental freedoms or privacy, they should not be the subject of processing.

This was, however, a relative prohibition. The second paragraph of article 8 of the Directive provided for various exceptions to the general prohibition to process such data.

The first exception to the principle prohibiting processing, for which the data subject has given his or her explicit consent to processing (Art. 8, paragraph 2 a) (see in this regard G29, Opinion 15/2011 on the definition of consent, WP 187).

In addition, several exceptions have been introduced to meet specific needs such as the processing needed to safety of life (Article 8,  2, c)); processing involving data which are made public by the data subject (Article 8, 2, e)); processing necessary for the  establishment, exercise or defence of legal claims (Article 8, 2 e); processing necessary for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services (Art. 8, 3)).

The processing needed for the purposes of complying with the obligations and the specific rights of the controller in the field of employment law (Art. 8, 2, b)).

There is also an exception from the prohibition for processing carried out by a foundation, an association or any other non-profit organization with a political, philosophical, religious or trade-union aim. The exception applies only to the processing of data relating to the members of such organization or the persons being in regular contact with such organization (Art. 8, 2, f)).

The Directive provided, under certain conditions, an exception to the processing of data relating to offences, criminal convictions or security measures (Art. 8, 5). To the extent that the future Regulations provide a specific provision for these cases of processing, we will examine them in more detail in the commentary on Article 9a. 

In addition to the exceptions expressly contained in the Directive, Article 8, paragraph 4 authorised the Member States to lay down additional exemptions for reasons of substantial public interest, either by national law or by decision of the supervisory authority. These additional exemptions must still be notified to the European Commission (Art. 8, paragraph 4).

Potential issues

For different purposes or types of data, the Member States reserve a substantial degree of flexibility in the determination of exceptions which must be based on specific legislation taken by that state. Significant differences may therefore still occur between the states, which undermines the goal of full harmonization of the law on personal data protection pursued by the Regulation.

Group 29

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (6 february 2018)

(Endorsed by the EDPB)

The General Data Protection Regulation (the GDPR), specifically addresses profiling and automated individual decision-making, including profiling.

Profiling and automated decision-making are used in an increasing number of sectors, both private and public. Banking and finance, healthcare, taxation, insurance, marketing and advertising are just a few examples of the fields where profiling is being carried out more regularly to aid decision-making.

Advances in technology and the capabilities of big data analytics, artificial intelligence and machine learning have made it easier to create profiles and make automated decisions with the potential to significantly impact individuals’ rights and freedoms.

The widespread availability of personal data on the internet and from Internet of Things (IoT) devices, and the ability to find correlations and create links, can allow aspects of an individual’s personality or behaviour, interests and habits to be determined, analysed and predicted.

Profiling and automated decision-making can be useful for individuals and organisations, delivering benefits such as:

• increased efficiencies; and
• resource savings.

They have many commercial applications, for example, they can be used to better segment markets and tailor services and products to align with individual needs. Medicine, education, healthcare and transportation can also all benefit from these processes.

However, profiling and automated decision-making can pose significant risks for individuals’ rights and freedoms which require appropriate safeguards.

These processes can be opaque. Individuals might not know that they are being profiled or understand what is involved.

Profiling can perpetuate existing stereotypes and social segregation. It can also lock a person into a specific category and restrict them to their suggested preferences. This can undermine their freedom to choose, for example, certain products or services such as books, music or newsfeeds. In some cases, profiling can lead to inaccurate predictions. In other cases it can lead to denial of services and goods and unjustified discrimination.

The GDPR introduces new provisions to address the risks arising from profiling and automated decision-making, notably, but not limited to, privacy. The purpose of these guidelines is to clarify those provisions.

This document covers:

• Definitions of profiling and automated decision-making and the GDPR approach to these in general – Chapter II
• General provisions on profiling and automated decision-making – Chapter III
• Specific provisions on solely automated decision-making defined in Article 22 - Chapter IV
• Children and profiling – Chapter V
• Data protection impact assessments and data protection officers– Chapter VI

The Annexes provide best practice recommendations, building on the experience gained in EU Member States.

The Article 29 Data Protection Working Party (WP29) will monitor the implementation of these guidelines and may complement them with further details as appropriate.

Link

CJEU caselaw

C-101/01 (6 November 2003)

1.    The act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes ‘the processing of personal data wholly or partly by automatic means’ within the meaning of Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

2.    Such processing of personal data is not covered by any of the exceptions in Article 3(2) of Directive 95/46.

3.    Reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal data concerning health within the meaning of Article 8(1) of Directive 95/46.

4.    There is no ‘transfer [of data] to a third country’ within the meaning of Article 25 of Directive 95/46 where an individual in a Member State loads personal data onto an internet page which is stored on an internet site on which the page can be consulted and which is hosted by a natural or legal person who is established in that State or in another Member State, thereby making those data accessible to anyone who connects to the internet, including people in a third country.

5.    The provisions of Directive 95/46 do not, in themselves, bring about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights, which are applicable within the European Union and are enshrined inter alia in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms signed at Rome on 4 November 1950. It is for the national authorities and courts responsible for applying the national legislation implementing Directive 95/46 to ensure a fair balance between the rights and interests in question, including the fundamental rights protected by the Community legal order.

6.    Measures taken by the Member States to ensure the protection of personal data must be consistent both with the provisions of Directive 95/46 and with its objective of maintaining a balance between freedom of movement of personal data and the protection of private life. However, nothing prevents a Member State from extending the scope of the national legislation implementing the provisions of Directive 95/46 to areas not included in the scope thereof provided that no other provision of Community law precludes it.

Opinion of Advocate general

Judgment of the Court

C-141/12 ; C-372/12 (17 July 2014)

1.      Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the data relating to an applicant for a residence permit contained in an administrative document, such as the ‘minute’ at issue in the main proceedings, setting out the grounds that the case officer puts forward in support of the draft decision which he is responsible for drawing up in the context of the procedure prior to the adoption of a decision concerning the application for such a permit and, where relevant, the data in the legal analysis contained in that document, are ‘personal data’ within the meaning of that provision, whereas, by contrast, that analysis cannot in itself be so classified.

2.      Article 12(a) of Directive 95/46 and Article 8(2) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities within the meaning of Article 2(b) of that directive. For that right to be complied with, it is sufficient that the applicant be in possession of a full summary of those data in an intelligible form, that is to say a form which allows that applicant to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by that directive.

3.      Article 41(2)(b) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that the applicant for a residence permit cannot rely on that provision against the national authorities.

Opinion of Advocate general

Judgment of the Court