Blog

Basically, special category personal data is personal data that is more sensitive in nature so therefore needs greater protection.

Specifically, special category personal data includes any information relating to:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• the processing of genetic data;
• biometric data (for the purpose of uniquely identifying someone);
• data concerning health;
• data concerning a person’s sex life or sexual orientation.

Genetic data

GDPR defines “genetic data” as personal data relating to the inherited or acquired genetic characteristics of an individual which give unique information about the physiology or the health of that individual which result, in particular, from an analysis of a biological sample from that individual.  (Ref: GDPR Article 4(13))

Furthermore, this includes chromosomal, DNA or RNA analysis, or from the analysis of another element enabling equivalent information to be obtained.  (Ref: GDPR Recital 34)

Biometric data

GDPR defines “biometric data” as personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allow or confirm the unique identification of that person, such as facial images or fingerprint data.  (Ref: GDPR Article 4(14))

The UK’s Information Commissioners Office also gives the following as examples of personal data that would fall under the definition of biometric data:

Examples of physical or physiological biometric identification techniques:

• iris scanning;
• retinal analysis;
• voice recognition; and
• ear shape recognition.

Examples of behavioural biometric identification techniques:

• keystroke analysis;
• handwritten signature analysis;
• gait analysis; and
• gaze analysis (eye tracking).

Health data

GDPR defines “data concerning health” as personal data related to the physical or mental health of an individual, including the provision of health care services, which reveal information about the individual’s health status.  (Ref: GDPR Article 4(15))

Furthermore, this includes all data pertaining to the health status of an individual that reveals information relating to the past, current or future physical or mental health status of that individual.  (Ref: GDPR Recital 35)

Basically, health data will include your full medical history from birth to death.  It even includes identifiers such as your NHS number.

Photographs

Generally, photographs do not fall under the definition of special category personal data.  They only fall under this definition when they are used to process biometric data.

Remember the processing activity of scanning the photograph through specific technical means to uniquely identify or authenticate someone needs to take place for the photograph to be classed as special category personal data.  (Ref: GDPR Recital 51)

Financial Information

You will note that GDPR does not define personal data relating to your finances as special category personal.  It is surprising, though, how many times I hear people tell me that finance data is special category personal data.  They are then the ones that become surprised to find out it’s not!  Obviously, you do still need to put appropriate protection in place to safeguard this type of data.

Nationality

An interesting question that businesses sometimes ask is whether nationality falls under the definition of special category personal data.  Nationality data is used by employers when they undertake Right to Work checks.

My opinion on this is that nationality does not fall under GDPR special category personal data as “nationality” refers to the country of citizenship, it is the relationship between a person and the political state to which they belong or are affiliated with. 

Quite often nationality gets confused with ethnicity, but their definitions are technically very different.  “Ethnicity” is the identification of a person with a particular racial, cultural, or religious group. GDPR classes racial or ethnic origin as Special Category Personal Data, not nationality. 

Criminal convictions and offences

Special category personal data does not include personal data about criminal allegations, proceedings or convictions.  This type of personal data is dealt with separately in the Data Protection Act 2018.