Article 9

GDPR Article 9 prohibits data controllers from processing “special categories of personal data.”

These categories include information that could reveal a data subject’s:

• Religious beliefs
• Political opinions
• Ethnic origins
• Trade union memberships
• Sexual orientation

Article 9 also bans processing of biometric data that could be used identify an individual, their health conditions, or information about their sex life.

There are quite few exemptions to Article 9, including if:

• A data subject provided consent for processing
• Processing protects the subject’s vital interests (keeps them alive)
• The data has already been made public by the data subject

A full list of Article 9 exemptions is available here.