What is special category data under GDPR Article 9?
Article 9(1) prohibits processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Article 4(15) defines data concerning health as personal data related to physical or mental health, including the provision of health care services, which reveal information about health status. Article 4(14) defines biometric data as data resulting from specific technical processing of physical, physiological or behavioural characteristics which allow or confirm unique identification. Article 4(13) defines genetic data. The EU GDPR Explained lists this prohibition in one line; the exam traps sit in the definitions and in what the Court treats as “revealing”.
Do you need both Article 6 and Article 9?
Article 9(1) is a prohibition that Article 9(2) can lift; Recital 51 still applies the general principles and other rules of the Regulation, in particular the conditions for lawful processing in Article 6(1). There is no “legitimate interests” point in Article 9(2). Article 6(1)(f) can therefore not, by itself, authorise special-category processing. Forum answers that stop at “get consent” under Article 6 miss the extra, explicit-consent or other Article 9(2) condition. Processing on a large scale of special categories referred to in Article 9(1) is a listed DPIA case under Article 35(3)(b). Article 22(4) adds a further lock: decisions under Article 22(2) must not be based on Article 9(1) data unless Article 9(2)(a) or (g) applies and suitable measures are in place.
Which everyday cases are in or out of GDPR Article 9 special category data?
A dataset is special-category processing when it reveals one of the Article 9(1) types, including by collation or deduction; a staff photograph stored without identification software is not, by Recital 51, automatically biometric special-category data.
| Situation | Article 9? | Why, on the primary sources |
|---|---|---|
| Staff ID photo in a personnel file, no facial-recognition processing | Not by Recital 51 alone | Recital 51: photographs should not systematically be treated as special category; they are biometric only when processed through a specific technical means allowing unique identification or authentication. |
| Facial-recognition clock-in that uniquely identifies employees | Yes, biometric | Article 9(1) covers biometric data for the purpose of uniquely identifying a natural person; Article 4(14) is the definition. |
| Name + delivery address + pharmacy-only medicine on an online order | Yes, health data | C-21/23 operative part 2: those details constitute data concerning health even without a prescription. |
| Spouse’s name in a public declaration from which sexual orientation can be deduced | Yes, if it can reveal the listed type | C-21/23 paragraphs 81–83 restate C-184/20: data capable of revealing the information by collation or deduction fall under the strengthened regime. |
| Criminal convictions or related security measures | No — Article 10 | Article 10 is a separate control-of-official-authority (or authorised-by-law) rule, not an Article 9 category. |
Are online pharmacy orders health data after Lindenapotheke?
In C-21/23, Lindenapotheke (Grand Chamber, 4 October 2024), the Court held that information customers enter when ordering pharmacy-only medicinal products on an online platform — such as name, delivery address and details required to individualise the products — constitutes data concerning health under Article 9(1), even where the sale does not require a prescription. That is operative part 2. Paragraph 83 is the test: it is enough that the data are capable of revealing health status by collation or deduction. Paragraph 84 applies that where the order links a medicinal product, its therapeutic indications or uses, and an identified or identifiable person. Paragraph 86: the classification does not depend on whether the information concerns the platform user or another person. Paragraph 87: the prohibition is independent of whether the revealed information is correct. Paragraphs 92–93 recall that processing remains possible if an Article 9(2) condition is met, in particular explicit consent under 9(2)(a) or healthcare under 9(2)(h). Article 9(3)’s professional-secrecy lock on 9(2)(h) is in the Regulation itself, not in those paragraphs of the judgment.
What are the ten exceptions in Article 9(2)?
Article 9(1) does not apply if one of Article 9(2)(a) to (j) applies: explicit consent; employment, social security and social protection authorised by law or a collective agreement; vital interests where the person cannot consent; not-for-profit body activities limited to members and regular contacts; data manifestly made public by the data subject; legal claims or courts acting judicially; substantial public interest based on law; healthcare under paragraph 3; public health based on law; or archiving, research or statistics in accordance with Article 89(1) based on law. Article 9(3) locks 9(2)(h) to processing by or under the responsibility of a person subject to professional secrecy. Article 9(4) lets Member States add further conditions, including limitations, for genetic, biometric or health data.
How was this guide checked?
GDPR Exam Trainer mapped each legal sentence to the English EUR-Lex text of Articles 4(13)–(15), 6(1), 9, 10, 22(4), 35(3)(b) and 83(5)(a) and to C-21/23 operative part 2 and paragraphs 83–87 and 92–93. The responsible organisation is GDPR Exam Trainer. The method is source mapping plus an independent citation gate, for DPO candidates — not legal advice. Practitioner pages below are qualitative signals of recurring questions, not legal sources.
Frequently asked questions
These answers apply Article 9, Recital 51, Article 10 and C-21/23 to the questions candidates actually ask about health data, photographs and “just use legitimate interest”.
Do you need both Article 6 and Article 9 to process special category data?
Yes for lawfulness. Article 9(1) is a prohibition that is lifted only by Article 9(2). Recital 51 still requires the general rules, including the Article 6(1) conditions for lawful processing. Article 6(1)(f) legitimate interest is not one of the ten Article 9(2) points, so it cannot by itself lift the prohibition.
Are photographs special category data under GDPR Article 9?
Not automatically. Recital 51 says processing of photographs should not systematically be treated as processing of special categories. Photographs fall under biometric data in Article 4(14) and Article 9(1) only when processed through a specific technical means allowing unique identification or authentication of a natural person.
Are online pharmacy orders health data after Lindenapotheke?
Yes, in the situation the Court decided. In C-21/23 (4 October 2024), name, delivery address and details that individualise pharmacy-only medicinal products ordered on an online platform are data concerning health under Article 9(1), even where the sale does not require a prescription.
Is criminal-conviction data a special category under Article 9?
No. Article 10 is a separate rule: personal data relating to criminal convictions and offences, or related security measures, based on Article 6(1), may be processed only under the control of official authority or when authorised by Union or Member State law that provides appropriate safeguards. A comprehensive register of criminal convictions is kept only under official-authority control.
What is the fine ceiling if Article 9 is infringed?
Article 83(5)(a) lists infringements of Articles 5, 6, 7 and 9 together. Those infringements are subject to administrative fines of up to EUR 20,000,000 or, for an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.