What is special category data, and what extra do you need to use it?

What it is

Processing special category data is prohibited unless an exception applies. The categories are: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about a person's sex life or sexual orientation.

When the extra rules apply

• You process any of the eight categories, including where they can be inferred with reasonable certainty, for example from purchase history or photos used to identify people. UK GDPR Art 9(1)
• You rely on the employment, social protection, health and social care, public health, archiving or research conditions: you also need the matching condition in DPA 2018 Sch 1 Part 1. DPA 2018 s.10; Sch 1 Part 1
• You rely on the substantial public interest condition: you need one of the conditions in DPA 2018 Sch 1 Part 2. UK GDPR Art 9(2)(g); DPA 2018 Sch 1 Part 2

When no extra condition is needed

• The person has given explicit consent, or has manifestly made the data public, or it is needed for legal claims or by a court: Art 9(2) alone is enough. UK GDPR Art 9(2)(a), (e), (f)

Who is responsible

The controller, which must document which Art 6 basis and which Art 9 condition it relies on for each use, and keep an appropriate policy document where Schedule 1 requires one.

What it involves

1. Identify the Art 6 lawful basis.
2. Identify the Art 9(2) condition.
3. Where the condition points to Schedule 1, identify the specific paragraph.
4. Write an appropriate policy document where the Schedule 1 condition requires it.
5. Complete a DPIA where the processing is large scale or otherwise high risk.

If it goes wrong

Regulatory

Processing special category data without a condition breaches Art 9. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

No offence for lacking a condition as such, but unlawfully obtaining or disclosing the data is an offence under DPA 2018 s.170 (unlimited fine).

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168. Courts treat misuse of health and similar data as serious when assessing distress.