New guidance alert! Last week the ICO released further guidance on the processing of special category personal data under the GDPR and Data Protection Act 2018 (DPA 2018).
The deep dive into the 23 (yes - 23!) 'substantial public interest' conditions set out in the DPA 2018 are of particular use; anyone who has attempted to navigate the DPA 2018 will be well aware of how nightmarish a task this is! The conditions themselves range from diversity at senior levels to anti-doping in sport, and everything in between, and give a basis in UK law for relying on Article 9(2)(g) of the GDPR to process special category personal data.
Be warned - for some of these conditions, different requirements must be met in order to rely upon them, so approach with caution. Luckily the ICO has set these out in a handy table.
Also, have a look at the section titled "What about inferences and educated guesses?", to find out whether making an inference about someone's religion, for example, triggers Article 9.
It’s not just that this type of information might be seen as more sensitive or ‘private’. The recitals to the GDPR explain that these types of personal data merit specific protection. This is because use of this data could create significant risks to the individual’s fundamental rights and freedoms. The presumption is that this type of data needs to be treated with greater care because collecting and using it is more likely to interfere with these fundamental rights or open someone up to discrimination. This is part of the risk-based approach of the GDPR.