1.3 Special Categories of Personal Data
The GDPR subjects the processing of special categories of personal data, which are
particularly sensitive and create significant risks, to reinforced protection in addition
to the general rules of the Regulation for lawful processing. Pursuant to Article 9 of
the GDPR, such special categories encompass: “personal data revealing racial or
ethnic origin, political opinions, religious or philosophical beliefs, or trade union
membership” as well as “genetic data, biometric data for the purpose of uniquely
identifying a natural person, data concerning health or data concerning a natural
person’s sex life or sexual orientation”. Article 4 of the GDPR provides definitions
of the terms ‘genetic data’, ‘biometric data’ and ‘data concerning health’ relevant for
these purposes.
The processing of the special categories of data listed in Article 9(1) is prohibited
unless one of the exceptions laid down in Article 9(2) applies: express consent by the
data subject to the extent that the prohibition may be lifted; processing is necessary
for the purposes of carrying out the obligations and exercising specific rights of the
controller or of the data subject in the field of employment and social security and
social protection law; processing is necessary to protect the vital interests of the data
subject; processing is carried out in the course of its legitimate activities with
appropriate safeguards by a foundation or any other not-for-profit body with a
political, philosophical, religious or trade union aim; processing relates to personal
data which are manifestly made public by the data subject; processing is necessary
for the establishment, exercise or defence of legal claims; processing is necessary for
reasons of substantial public interest, on the basis of Union or Member State law. . .
Furthermore, the GDPR allows Member States to maintain or introduce further
conditions with regard to the processing of genetic data, biometric data or data
concerning health.
The GDPR imposes similar obligations with regard to the processing of personal
data on public actors and private parties. However, public authorities to which
personal data are disclosed in accordance with a legal obligation for the exercise
of their official mission are not regarded as recipients if they receive personal data
which are necessary to carry out a particular inquiry in the general interest, in
accordance with Union or Member State law [Article 4(9) GDPR].
1.4 Supervisory Authorities
Under the GDPR, the establishment of supervisory authorities in Member States,
empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to
the processing of their personal data. Member States are able to establish more than
one supervisory authority to reflect their constitutional and organisational structure
(art. 51 GDPR). Each supervisory authority is competent on the territory of its own
Data Protection in the Internet: A European Union Perspective
461
The GDPR subjects the processing of special categories of personal data, which are
particularly sensitive and create significant risks, to reinforced protection in addition
to the general rules of the Regulation for lawful processing. Pursuant to Article 9 of
the GDPR, such special categories encompass: “personal data revealing racial or
ethnic origin, political opinions, religious or philosophical beliefs, or trade union
membership” as well as “genetic data, biometric data for the purpose of uniquely
identifying a natural person, data concerning health or data concerning a natural
person’s sex life or sexual orientation”. Article 4 of the GDPR provides definitions
of the terms ‘genetic data’, ‘biometric data’ and ‘data concerning health’ relevant for
these purposes.
The processing of the special categories of data listed in Article 9(1) is prohibited
unless one of the exceptions laid down in Article 9(2) applies: express consent by the
data subject to the extent that the prohibition may be lifted; processing is necessary
for the purposes of carrying out the obligations and exercising specific rights of the
controller or of the data subject in the field of employment and social security and
social protection law; processing is necessary to protect the vital interests of the data
subject; processing is carried out in the course of its legitimate activities with
appropriate safeguards by a foundation or any other not-for-profit body with a
political, philosophical, religious or trade union aim; processing relates to personal
data which are manifestly made public by the data subject; processing is necessary
for the establishment, exercise or defence of legal claims; processing is necessary for
reasons of substantial public interest, on the basis of Union or Member State law. . .
Furthermore, the GDPR allows Member States to maintain or introduce further
conditions with regard to the processing of genetic data, biometric data or data
concerning health.
The GDPR imposes similar obligations with regard to the processing of personal
data on public actors and private parties. However, public authorities to which
personal data are disclosed in accordance with a legal obligation for the exercise
of their official mission are not regarded as recipients if they receive personal data
which are necessary to carry out a particular inquiry in the general interest, in
accordance with Union or Member State law [Article 4(9) GDPR].
1.4 Supervisory Authorities
Under the GDPR, the establishment of supervisory authorities in Member States,
empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to
the processing of their personal data. Member States are able to establish more than
one supervisory authority to reflect their constitutional and organisational structure
(art. 51 GDPR). Each supervisory authority is competent on the territory of its own
Data Protection in the Internet: A European Union Perspective
461