Under the GDPR, a fitness app stores users' heart-rate data; why is an Art. 6 lawful basis alone not enough?
answer
- two gates, not one
- prohibition first, then exceptions
- health data are special category
- Art. 9(2) conditions
basics
~20 sHeart-rate readings are data concerning health, a special category that GDPR Art. 9(1) prohibits processing by default. The app needs both an Art. 6(1) basis and one of the Art. 9(2) conditions, for a consumer app typically explicit consent under Art. 9(2)(a).
solid answer
~50 sUnder the GDPR, heart-rate readings reveal information about physical health, so they are generally **data concerning health** (`Art. 4(15)`, Recital 35), one of the special categories in `Art. 9(1)`. For those categories the Regulation works as **two gates**: `Art. 9(1)` *prohibits* processing unless one of the conditions in `Art. 9(2)` applies, and Recital 51 says the general rules, including the conditions for lawful processing, apply *in addition*. So the app needs an `Art. 6(1)` basis **and** an `Art. 9(2)` condition. For a consumer fitness app most conditions do not fit: (h) needs law or a contract with a health professional under secrecy, (i) and (g) need a public-interest law, and (e) covers only data the user manifestly made public. The realistic condition is **explicit consent** under `Art. 9(2)(a)`, a higher bar than ordinary consent. Member States may add further conditions for health data (`Art. 9(4)`).
go deeper
Recall that special-category data such as health data need an Art. 6 basis and an Art. 9(2) condition, because Art. 9(1) prohibits processing by default.
Walk the Art. 9(2) list against a consumer app and explain why (h), (g), (i) and (e) do not fit, leaving explicit consent under (a).
Handle second purposes and national variation: each new use of health data needs both gates again, and Art. 9(4) lets Member States add conditions.
Decide whether a product line should process health data at all, since every new purpose re-opens both gates and national conditions multiply the compliance surface.
## Why heart-rate data trigger a second test The GDPR treats some personal data as **special categories**, listed in `Art. 9(1)`. Data concerning health is one of them. `Art. 4(15)` defines it as personal data related to the physical or mental health of a natural person that reveal information about their health status, and Recital 35 reads it broadly, covering the *physiological or biomedical state* of the person independent of its source. Continuous heart-rate readings from a wearable reveal physical condition, so they are generally treated as health data. For special categories the Regulation does not simply demand a lawful basis. It starts from a **prohibition**. ## The two gates | Gate | Provision | Question | |---|---|---| | **1. Lawfulness** | `Art. 6(1)` | Which of the six bases makes this processing lawful? | | **2. Special-category condition** | `Art. 9(1)` prohibition, lifted by `Art. 9(2)` | Which of the listed conditions permits processing these data? | Recital 51 makes clear that the gates are cumulative: *in addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing*. Passing one gate does not open the other. ## The Art. 9(2) conditions `Art. 9(2)` lists ten conditions, points (a) to (j): - **(a)** explicit consent for one or more specified purposes, unless law says the prohibition cannot be lifted by consent; - **(b)** obligations and rights in employment, social security and social protection law, as authorised by law or a collective agreement; - **(c)** vital interests where the data subject is physically or legally incapable of giving consent; - **(d)** legitimate activities of a not-for-profit body with a political, philosophical, religious or trade union aim, concerning its members; - **(e)** data manifestly made public by the data subject; - **(f)** establishment, exercise or defence of legal claims, or courts acting judicially; - **(g)** substantial public interest on the basis of Union or Member State law; - **(h)** preventive or occupational medicine, medical diagnosis, health or social care, on the basis of law or a contract with a health professional, subject to the secrecy conditions in `Art. 9(3)`; - **(i)** public health, on the basis of law; - **(j)** archiving, research or statistics, on the basis of law, in accordance with `Art. 89(1)`. ## Which condition fits a consumer fitness app Walk the list against the facts: a private company offering an app that records heart rate to show training zones and trends. 1. **(h) does not fit** a general fitness product: it covers medicine, diagnosis and care on the basis of law or under contract with a health professional bound by secrecy (`Art. 9(3)`). 2. **(g), (i) and (j) need a Union or Member State law** providing for the processing; a commercial app has none. 3. **(e) does not fit**: a user syncing a wearable has not manifestly made the readings public. 4. **(b), (c), (d) and (f)** concern employment law, incapacity, not-for-profit bodies and legal claims, none of which describe the core service. 5. **(a) explicit consent** is the realistic condition. How explicit consent must be obtained and recorded is a subject of its own; the point here is that it is a stronger requirement than ordinary consent. The app then still needs its `Art. 6(1)` basis. The two choices are made separately and each must genuinely fit the purpose. ## What else attaches to health data - **National rules.** `Art. 9(4)` lets Member States maintain or introduce further conditions, including limitations, for genetic, biometric and health data, so the answer can differ by country. - **Each purpose separately.** Showing the user their training zones and using the same readings for insurance-style risk scoring or advertising are different purposes, each needing both gates again, and explicit consent under (a) is given for specified purposes. - **Further processing.** Reusing health data for a new purpose weighs heavily under `Art. 6(4)(c)`, which names special categories as a factor against compatibility. - **Automated decisions.** `Art. 22(4)` bars decisions under `Art. 22(2)` based on special categories unless (a) or (g) applies with suitable safeguards. ## Common mistakes - Treating an `Art. 6` basis as sufficient for health data. - Assuming legitimate interests can lift the `Art. 9(1)` prohibition. It cannot: it is an `Art. 6` basis, not an `Art. 9(2)` condition. - Reading (h) as covering anything health-related. - Treating an ordinary consent checkbox as explicit consent.
- Under the GDPR, can a fitness app rely on legitimate interests to process heart-rate data?Legitimate interests is an `Art. 6(1)(f)` basis; it can satisfy the first gate at most. It is not among the `Art. 9(2)` conditions, so it cannot lift the `Art. 9(1)` prohibition on health data. The app still needs a condition such as explicit consent under `Art. 9(2)(a)`.
- Under GDPR Art. 9(2)(h), when could health data processing rely on that condition instead of explicit consent?When it is necessary for preventive or occupational medicine, assessment of working capacity, medical diagnosis, or providing or managing health or social care, on the basis of Union or Member State law or under a contract with a health professional, and processed by or under the responsibility of someone bound by professional secrecy (`Art. 9(3)`). A general consumer fitness product does not meet those conditions.
- Under GDPR Art. 9(4), why might the answer for health data differ between Member States?`Art. 9(4)` allows Member States to maintain or introduce further conditions, including limitations, for genetic data, biometric data and data concerning health. A product processing health data across the Union must check whether national law in each market adds requirements on top of the Regulation.
saying these in an interview costs you the question
- Any Art. 6 basis is enough for health data, as for other personal data.
- Legitimate interests can lift the Art. 9(1) prohibition on special categories.
- Art. 9(2)(h) covers any processing connected to health or fitness.
- An ordinary consent checkbox counts as explicit consent under Art. 9(2)(a).
- Once explicit consent is given for training zones, any use of the data is covered.