Article 9 establishes heightened protections for data types that carry elevated risk of discrimination, harm, or privacy violation. The special categories it covers are:
Processing these categories is prohibited by default. To process them lawfully, organizations must satisfy one of the explicit exceptions in Article 9(2), which include explicit consent (a higher bar than standard GDPR consent), employment law obligations, vital interests, protection of public health, and scientific research under appropriate safeguards.
The practical significance of Article 9 has grown considerably with AI adoption. Machine learning models can infer special category data, including health status, political views, and sexual orientation, from seemingly innocuous behavioral data.
This creates Article 9 exposure even when an organization believes it isn't processing sensitive data. Organizations deploying AI systems that analyze customer behavior need to assess whether their models are effectively processing special category data by inference.