23
Wed, Sep
54 New Articles

The Conundrums of Processing Special Categories of Personal Data Under the General Data Protection Regulation (I)

The Conundrums of Processing Special Categories of Personal Data Under the GDPR (I)

Romania
Tools
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) aims at introducing concepts and rules to strengthen the protection of fundamental rights and freedoms of natural persons in respect of data processing activities. The question has been raised on whether and how the GDPR achieves this in relation to special categories of personal data, with opinions expressed as far as to question whether a specific regime for such categories of data is still adequate when we all agree that there may be not the data itself that is special or sensitive but rather its use.

We have analyzed from certain perspectives the GDPR rules on processing special categories of data in a three-fold article aimed at discussing where conundrums lie. This one focuses on whether there is any synergy (intended or achieved) between Articles 6 and 9 of the GDPR, whereas the second and third parts will focus on the specific circumstances (with practical considerations) when processing special categories of personal data is allowed.

1. Special circumstances for special personal data processing …

According to Article 9 of the GDPR, the processing of special categories of personal data is prohibited where at least one of the exemptions for processing identified therein is not met. There are ten such exemptions provided for by the GDPR itself, the Member States being allowed to maintain or introduce further conditions (including limitations) under which the processing of special categories of personal data is lawful.

2. …. but not so special legal grounds

At a first glance, the meeting of one of the conditions provided in Article 9 paragraph (2) of the GDPR suffices for the purpose of lifting the interdiction to process special categories of personal data. Generally, there subsists a view that the exemptions provided under Article 9 of the GDPR constitute legal grounds for processing. The similarity between some of the circumstances in Article 9 and the legal grounds in Article 6 of the GDPR strengthens this view.

However, this does not seem to have been the intention of the GDPR legislator. In fact, the Article 29 Working Party (“WP29”) clarified that, starting from the general objective of providing a higher level of protection to special categories of data, the data controller should assess on a case-by-case basis whether the application of one of the exemptions in Article 9 is sufficient by itself to achieve the objective or one of the grounds in Article 6 should apply cumulatively. Unfortunately, the WP29 neither clarifies the circumstances in Article 9 that are able to provide protection in isolation, without requiring cumulation nor, where such cumulation is needed, the correspondence between circumstances and legal grounds.

3. When special circumstances and legal grounds meet

We have conducted a comparative analysis of the special circumstances in Article 9 and the legal grounds in Article 6 to identify correspondence. Notwithstanding the fact that any special circumstance could be theoretically combined with any legal ground, some predefined links seems to exist, as follows:  

Special circumstances … … and legal grounds

1. Explicit consent - Consent: It may be considered that explicit consent, which presumably ensures stricter and better protection, can be used as basis for special categories of personal data processing with no further correlation with Article 6 needed.

2. Vital interests of a person physically or legally incapable of giving consent - Vital interests of a person: It may be considered that vital interests of a person physically or legally incapable of giving consent, which presumably ensures stricter and better protection, can be used as basis for special categories of personal data processing with no further correlation with Article 6 needed.

3. Substantial public interest - Performance of a task in the public interest: It may be considered that substantial public interest, which presumably ensures stricter and better protection, can be used as basis for special categories of personal data processing with no further correlation with Article 6 needed.

4. Other exemptions - No visible corresponding lawful basis: Any of the remaining seven exemptions / special circumstances require in our view that we deem reasonable combination with an adequate lawful basis for processing under Article 6.
As far as the last four exemptions / special circumstances are concerned, GDPR points to the legal obligation as legal basis for special categories of data processing.
- non-profit bodies in relation with their members
- data manifestly made public by the data subject
- legal claims or processing by courts
- employment, social security or social protection laws
- health and social care
- public health
- archiving or scientific and historical research or statistical purposes. 

4. A paramount absence

One of the legal bases for regular personal data processing that proves very useful in particular industries or areas is the contract performance. Article 9 missed the opportunity to establish a full correspondence with Article 6 in relation to this legal basis. As a result, no special categories of personal data can be processed exclusively based on contract performance, and, therefore, a cumulation with one of the circumstances in Article 9 is needed. Most often, the special circumstance for processing matching with the contract performance is the explicit consent of the data subject.

We take the example of a controller that concludes an agreement with an individual based on which it processes the individual’s personal data required in view of that contract performance, both regular and special personal data, in this latter case relying on the individual’s explicit consent. This  may give rise to awkward situations when the individual whose data is processed withdraws his/her consent. In such situation, if the controller has no (other) cause to terminate the agreement (the mere withdrawal of consent by the individual does not amount to a cause, as consent is essentially retractable), it continues to be bound by the obligation to perform the agreement, which it cannot do in the absence of a possibility to process the special categories of personal data (such as biometric data).

By Monica Iancu, Partner, and Andra Turtoi, Senior Associate, Bondoc si Asociatii

Bondoc si Asociatii at a Glance

Bondoc și Asociații SCA is a leading Romanian law firm advising private corporations, public entities and lending institutions in the development of significant and increasingly integrated projects in a wide range of practice areas, including corporate and commercial law, M&A, banking & finance (including also structural funds and state aid), energy, capital markets, competition law, labor, real estate, IT&C, regulatory and compliance. Its lawyers are specialized in providing integrated advice on virtually every legal aspect associated with complex cross-border transactions, as well as domestic projects.

We have the experience and necessary resources to advise private corporations, public entities and financial institutions in their cross-border expansion, in the development of significant and increasingly integrated projects.

In terms of M&A transactional work, our team has been involved in many significant transactions covering a broad range of industries.

We are one of the few firms capable of assisting in a professional manner on virtually any type of M&A project in any industry in Romania and of any size, including with respect to highly regulated sectors or in connection with public authorities.

We have very strong departments in all support areas needed for such transactions, including without limitation competition, commercial law, real estate, labor law, banking &finance, energy, environment, and other regulatory.

Key Information:

  • 9 partners;
  • 40 lawyers, most of whom have also studied abroad;
  • Covering the full range of legal services;
  • Having worked on many of the largest and most complex projects in the Romanian market in the past 3 years;
  • One of the very few Romanian law firms growing in the market;
  • Highly recommended by international directories in 11 areas of law.

We offer:

  • Integrity;
  • A Client-oriented approach;
  • Top quality services, including in highly regulated sectors;
  • A size allowing for the coverage of several large projects at the same time;
  • Very strong experience in both domestic and international complex projects, including in highly regulated sectors;
  • A holistic approach.

Expertise:

Our lawyers have wide experience in dealing with complex and sophisticated legal matters.

  1. Banking & Finance
  2. Capital Markets
  3. Commercial
  4. Competition
  5. Corporate / Mergers & Acquisitions
  6. Data Protection
  7. Employment
  8. Energy & Natural Resources
  9. Environment & Regulatory
  10. Healthcare/Pharma & Medical Services
  11. Insurance and Private Pensions
  12. Intellectual Property
  13. IT/Technology & Communications
  14. Litigation & Arbitration
  15. Media, Entertainment & Advertising
  16. Public Procurement & PPP
  17. Real Estate& Constructions
  18. Restructuring & Liquidation
  19. State Aid & European Structural Funds
  20. White Collar / Investigations & Compliance

For further information about Bondoc si Asociatii Law Firm, please visit our website at bondoc-asociatii.ro.