HumenhukCIPP/E Study Guide
IAPP Training, Module 2 - BoK II.A

Module 2, Special categories of personal data (Article 9)

Reviewed by Victor Humenhuk. Published . Reviewed .

Article 9(1) prohibits processing of special-category data unless an exception applies. The categories cover racial/ethnic origin, political opinions, religious/philosophical beliefs, trade-union membership, genetic data, biometric data (for unique identification), health, sex life and sexual orientation. Case C-184/20 extends Article 9 to data liable indirectly to reveal sensitive information. Article 10 governs criminal-conviction data. Special-category status can be subjective/contextual.

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade-union membership
  • genetic data
  • biometric data processed for the purpose of uniquely identifying a person
  • Data concerning health
  • Sex life or sexual orientation

Article 9(1) makes processing of these categories prohibited unless an exception applies. Case C-184/20 (CJEU) held that processing any personal data liable indirectly to reveal sensitive information is subject to the Article 9(1) prohibition - significantly expanding Article 9's scope (special category by inference).

Article 10 covers data on criminal convictions and offences: it may be processed only under the control of official authority or when authorised by Union/Member State law with appropriate safeguards; comprehensive criminal registers only under official authority.

Context matters

Special-category status can be subjective and non-obvious: an X-ray of a broken arm is health data, but a holiday photo of someone with an arm in a cast may NOT be health data - it does not necessarily concern their health.

Key terms - quick answers

What is “Article 9(1)”?
Prohibits processing of special categories of personal data unless an exception applies.
What is “genetic data”?
A special category under Article 9 relating to inherited or acquired genetic characteristics.
What is “biometric data”?
Special-category data only when processed for the purpose of uniquely identifying a natural person.
What is “Case C-184/20”?
CJEU decision: data liable indirectly to reveal sensitive information falls under the Article 9(1) prohibition (special category by inference).

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.