Special Categories of Personal Data, Criminal Convictions and Personal Identity Numbers
The processing of personal data pertaining to special categories is more strictly regulated than other processing. In principle, all processing of special categories of personal data is prohibited. Such data are:
data, which reveals a person’s racial or ethnic origin
data, which reveals a person’s political opinion, religion or philosophical beliefs or trade union membership
genetic or biometric data, which is processed in order to identify a person
data concerning health
data concerning sexual activity or sexual orientation
Personal data belonging to special categories can be processed only with the explicit consent of the data subject, or on grounds defined in the GDPR. These exceptions from the prohibition are, for instance, processing that is necessary in order to comply with regulations regarding employment, social security and social protection law, processing in order to file or respond to a lawsuit, processing for the purpose of conducting historical or scientific research or for statistical purposes. The processing of personal data must always be necessary and objectively justified.
In addition, processing of personal data in connection to criminal convictions and offences or precautionary measures in relation to this is only permitted within the supervision of public authorities, or when the law of an EU member state allows. As confirmed in the national legislation, such data can be processed, for instance, if it is necessary for the investigation, establishment, exercise, defense or resolution of a legal claim, when an insurance institution processes data to investigate liability or when the criminal records of person selected to work with minors are clarified.
The conditions for collecting personal identification numbers are also stricter than for other types of personal data. Requesting personal identity numbers is justified for credit granting, health care and for employment relationships. The Office of the Data Protection Ombudsman has also issued statements about when the collection of personal identification number is permitted. Although the controller would have the right to handle the personal identification numbers, it shall ensure that the numbers are not unnecessarily entered in documents printed from a register.