Clients often come to us concerned about the incidental special data that they process.

The UK GDPR distinguishes between ‘normal’ data, and ‘special’ data, i.e.:

  • personal data revealing racial or ethnic origin;
  • personal data revealing political opinions;
  • personal data revealing religious or philosophical beliefs;
  • personal data revealing trade union membership;
  • genetic data;
  • biometric data (where used for identification purposes);
  • data concerning health;
  • data concerning a person’s sex life; and
  • data concerning a person’s sexual orientation.

Clients are understandably concerned about the processing of incidental special data. For example:

  • somebody’s photo for the website may disclose their racial or ethnic origin;
  • somebody’s dress or jewellery may disclose their religious beliefs;
  • the fact we have ordered an ergonomic chair for somebody may reveal data concerning health;
  • the fact somebody lists their spouse of the same gender as their emergency contact may reveal their sexual orientation.

To the extent that personal data is ‘special data’, a data controller needs an article 9 condition for processing. Do clients therefore need an article 9 condition for the processing of this data?

These conditions are limited, and in the HR context are most likely that;

  1. processing is necessary for the purposes of complying with a legal obligation (e.g. providing reasonable adjustments or complying with health and safety); or
  2. processing is necessary for substantial public interest (e.g. necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people).

These will only apply in very limited circumstances.

Thankfully, the ICO has published guidance on inferred special data. It states that ‘you do not have to treat all such names or images as special category data in every instance’.

Article 9 will only be triggered:

  1. Where your processing intends to make the inference linked to the special data; or
  2. You intend to treat someone differently on the basis of the inferred information.

Clients therefore don’t need to have an Article 9 basis for processing for the abovementioned examples of inferred information – which is a welcome relief!