Understanding Special Category Data under GDPR
Overview of Special Category Data
Special category data, akin to sensitive personal data under the 1998 Data Protection Act, now encompasses genetic and some biometric data under GDPR.
Determining Lawful Basis and Conditions
When processing special category data, organisations must:
- Determine lawful basis: Identify the appropriate lawful basis for processing such data.
- Meet Article 9 conditions: Ensure compliance with the most suitable condition under Article 9 of GDPR.
Conditions for Processing
Conditions for processing special category data may include:
- Explicit consent: Obtain explicit consent from the data subject.
- Other relevant conditions: Explore conditions applicable to public health and interests, if relevant.
Processing Criminal Offences Data
Processing personal data related to criminal offences or convictions is now governed separately:
- Legal authority: Require both a lawful basis and legal or official authority for processing such data.
- Compliance with Article 10: Adhere to Article 10 regulations for processing criminal data.
Additional Resources
For detailed guidance and further information:
Visit the ICO website: www.ico.org.uk