Under GDPR Art. 9(1), which personal data are special categories, and why are criminal records and bank details not among them?

## The list in Art. 9(1) The GDPR (Regulation (EU) 2016/679) singles out certain personal data as **special categories**. `Art. 9(1)` names them: - personal data **revealing racial or ethnic origin**; - personal data **revealing political opinions**; - personal data **revealing religious or philosophical beliefs**; - personal data **revealing trade union membership**; - **genetic data**; - **biometric data for the purpose of uniquely identifying a natural person**; - **data concerning health**; - data concerning a natural person's **sex life or sexual orientation**. Recital 51 explains why: these data are *by their nature particularly sensitive* in relation to fundamental rights and freedoms, because the context of their processing could create significant risks. ## The defined terms inside the list Three items have their own definitions in `Art. 4`: | Term | Definition in short | Where | |---|---|---| | **Genetic data** | Data on inherited or acquired genetic characteristics giving unique information about physiology or health, in particular from analysing a biological sample | `Art. 4(13)` | | **Biometric data** | Data from specific technical processing of physical, physiological or behavioural characteristics that allow or confirm unique identification, such as facial images or fingerprint data | `Art. 4(14)` | | **Data concerning health** | Data on physical or mental health, including the provision of health care services, that reveal information about health status | `Art. 4(15)` | Two readings matter in engineering work: 1. **Biometric data are special category only when used to uniquely identify.** `Art. 9(1)` says *biometric data for the purpose of uniquely identifying a natural person*, and Recital 51 adds that photographs are not systematically special-category data; they are covered by the biometric definition only when processed through specific technical means allowing unique identification or authentication. A profile photo is personal data; a face template used to log someone in is biometric data under Art. 9(1). 2. **Health data are read broadly.** Recital 35 covers data revealing past, current or future physical or mental health status, including a number assigned to identify someone for health purposes and information on a disease risk or medical history, independent of its source. ## "Revealing": data that disclose, not only data that state Four of the categories are framed as personal data **revealing** an attribute. The text therefore reaches data from which the attribute can be read, not only a field literally labelled "religion". How far an inference brings data within Art. 9(1) is a matter of interpretation, and the careful engineering answer is to ask what a dataset reveals, not what its columns are called. ## Why criminal records and bank details are not on the list - **Criminal convictions and offences.** The GDPR handles these in **`Art. 10`**, a separate regime: processing based on Art. 6(1) may take place only under the control of official authority or when authorised by Union or Member State law with appropriate safeguards, and any comprehensive register of criminal convictions may be kept only under official authority. Other articles name the two side by side, for example `Art. 27(2)(a)`, `Art. 30(5)` and `Art. 35(3)(b)`, which confirms that criminal data are a separate class rather than a special category. - **Financial data.** Bank account numbers, card numbers and salaries are **ordinary personal data** under the GDPR. Their leak may be high-risk, and that risk counts in security and breach assessments, but risk does not add a category to a closed list. ## Why the label matters Classifying data as special category changes the obligations around it: - `Art. 9(1)` starts from a **prohibition** on processing, with exceptions in `Art. 9(2)`; which exception applies is a separate subject. - A **data protection impact assessment** is required for large-scale processing of special categories or criminal-offence data (`Art. 35(3)(b)`). - A **DPO** must be designated where core activities consist of large-scale processing of such data (`Art. 37(1)(c)`). - The small-organisation exemption from **records of processing** falls away when special categories are processed (`Art. 30(5)`). - The **EU representative** exemption for non-EU companies is unavailable for large-scale special-category processing (`Art. 27(2)(a)`). - Automated decisions under `Art. 22` may not be based on special categories except in the cases `Art. 22(4)` allows. ## Common mistakes - Treating **financial data** or **national ID numbers** as special categories. - Treating **every photo** as biometric data. - Filing **criminal records** under Art. 9 instead of Art. 10. - Assuming a column must be named "health" to hold health data.