Sensitive Personal Data (Special Category Data)

Most personal data can be used on fairly ordinary grounds. Certain kinds carry a higher risk of unfair treatment, so laws pick them out for tighter rules. The EU's GDPR calls them special categories. They cover health, genetic and biometric data (the last only when used to identify someone), data about sex life or orientation, and data revealing racial or ethnic origin, political views, religion or union membership. Fingerprints and face templates fall under the last group only when they are used to recognise a specific person; a plain photograph usually does not. The lists differ by country, and some laws set no separate category at all. Typically the organisation needs a narrower legal basis, such as explicit consent, plus stronger security and often a privacy assessment before it begins. Regulators tend to penalise slips with this data harder, since a leaked diagnosis or political view cannot be taken back.

A hospital group wants to add fingerprint scanners for staff to clock in. Fingerprints are biometric data used to identify people, so the privacy team treats them as sensitive. It asks whether a badge would do the same job, offers staff a non-biometric option, encrypts the templates, and completes an impact assessment before the rollout.