B.III The individual categories
Each of the eight sensitive data categories under Art. 9(1) GDPR explained – with everyday examples.
Back to the Art. 9 GDPR overview | B. The prohibition of processing
At a Glance
Art. 9(1) lists the sensitive data categories exhaustively – there are no others. In case of doubt, the list is interpreted broadly, because the protection of data subjects takes precedence.
1. Racial and ethnic origin
What is meant?
"Race" is not understood here in a biological sense, but in a social sense: it concerns how a person is perceived or which group they perceive themselves as belonging to.
Covered are data on:
- Nationality, skin colour, language, region of origin
- Self-attributions or external attributions of ethnic identity
What is not covered?
Not every piece of information about nationality or origin triggers the prohibition. What matters is whether the data are capable of revealing ethnic affiliation. Pure nationality information in a passport alone is not sufficient – but it can become so if it appears in a profile alongside ethnic characteristics.
2. Political opinions
What is meant?
All convictions concerning politics, the state and society: party affiliation, voting behaviour, political statements on social media, participation in demonstrations.
Distinction
Overlaps with philosophical beliefs (→ category 3) are possible. Anyone pursuing a political programme on philosophical grounds is covered by both categories.
3. Religious and philosophical beliefs
Religion
All faith and belief systems – regardless of how widespread. Non-religion (e.g. atheism) is also covered.
Typical examples: church tax markers, religious dress codes, dietary requirements in the canteen.
Philosophical belief
Comprehensive convictions that are not religious but shape one's life – for example humanism or veganism as a life philosophy.
Whether it is religion or philosophical belief is irrelevant for the legal consequences – both are treated equally.
4. Trade union membership
What is meant?
Membership in trade unions and professional associations with a trade union function, for example:
- ver.di, IG Metall, DGB
- Activities as a works council member or trade union representative
- Participation in strikes
What is not covered?
Employer associations and professional associations without a collective bargaining function (e.g. purely professional organisations) are not covered by Art. 9.
5. Genetic data
What is meant?
Data relating to inherited or acquired genetic characteristics of a person – obtained, for example, through DNA analysis, genetic mutation testing, or ancestry analysis.
Special feature
Genetic data concern not only the data subject themselves, but also their relatives. This is why they are particularly sensitive.
For genetic data, Germany may introduce additional rules (→ D. Opening clause).
6. Biometric data
What is meant?
Data obtained by technical means relating to physical or behavioural characteristics that uniquely identify a person – e.g. fingerprints, facial images, voice profiles.
Limitation: purpose of identification
For biometric data, Art. 9 only applies if they are used for the purpose of uniquely identifying a person.
| Situation | Art. 9 applies? |
|---|---|
| Fingerprint scanner for access control | Yes |
| Facial recognition in databases | Yes |
| Statistical analysis of facial shapes without personal reference | No |
| Voice identification | Yes |
7. Health data
What is meant?
All data that reveal something about the physical or mental health condition of a person:
- Diagnoses, findings, medical reports
- Health insurance data and billing data
- Pharmacy data (medication purchases)
- Fitness data, step counters (insofar as health-relevant)
- Disability characteristics, levels of care
For health data, the special rules in Art. 9(3) also apply (→ C – Health sector).
8. Sex life and sexual orientation
What is meant?
Sex life: Information about sexual practices, forms of relationships, relationship partners.
Sexual orientation: The fundamental orientation of sexual attraction (e.g. heterosexual, homosexual, bisexual).
Distinction
The sex of a person (male/female) only falls under Art. 9 if conclusions about sexual orientation can be drawn from it – e.g. in the case of information on gender identity or transsexuality.
Practical note: On social networks, information on relationship status and partner in conjunction with profile information may allow conclusions about sexual orientation – in which case Art. 9 applies.
Frequently Asked Questions (FAQ)
Is the list of eight categories exhaustive? Yes. There are no further categories. If data do not fall under one of these eight categories, Art. 9 does not apply.
What if a piece of data touches several categories? Then all the categories concerned apply simultaneously – this does not change the level of protection.
Do I always have to know which category applies? Yes, because each category can have different exceptions. In case of doubt, broad interpretation is recommended.
Next: C. Exceptions – overview