What is special category data and what does this mean? #GDPR

Special categories of personal data – those described in Article 9 of the GDPR – may not be processed except for specified purposes also set out in Article 9 and sometimes subject to special conditions.

Special categories of personal data that may not be processed unless there is a specific exception are:

… personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation... 

Therefore, as may be expected data concerning health is a special category of data. It has a specific meaning as follows.

‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

Data concerning health and other special categories of data may be processed where: 

(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

Paragraph 3 requires a person who is subject to a professional obligation of confidentiality to be responsible for the processing of the data concerning health. Our understanding is that such a person must be a registered professional to practise and subject to removal from the register if unfit to practise; this could be a pharmacist or pharmacy technician.

View our GDPR page for more information