Article 9 AVG

Article 9 of the GDPR governs the processing of special categories of personal data under European privacy law. This data is particularly sensitive and may only be collected and used under strict conditions. Examples include health data, religious beliefs, biometric data, and information about a person’s sexual orientation. For small and medium-sized business owners working in human resources, healthcare, or membership services, this article specifies what information you may and may not record.

What data falls under Article 9 of the GDPR?

The article explicitly lists nine categories of special categories of personal data. These include race or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership. Genetic data, biometric data that uniquely identifies a person, health data, and data regarding a person’s sexual behavior or orientation are also included. This list is exhaustive, meaning that other data falls outside the scope of this article. In practice, we often see confusion among employers who believe that all personnel data is special. That is not correct: a bank account number or phone number falls under the general rules of the GDPR, not under Article 9. The key factor is sensitivity: could the data lead to discrimination or stigmatization? If so, there is a good chance it falls under Article 9.

When are you permitted to process special categories of personal data?

The general rule is simple: processing this data is prohibited. However, Article 9 lists ten exceptions that do permit processing. The most important ones for small and medium-sized businesses are: explicit consent from the data subject, necessity for labor law purposes (such as recording sick leave), or a legal obligation. You may also use data that the data subject has made public themselves, subject to certain conditions. Please note: consent alone is often not enough. You must be able to demonstrate that the processing is both necessary and proportionate. A gym that asks about religious beliefs in order to create a workout plan cannot substantiate that necessity. A healthcare facility that records medication use for a treatment plan, however, can. The Dutch Data Protection Authority regularly publishes examples of permitted and prohibited processing activities.

How Article 9 of the GDPR Affects Business Operations

For companies with employees or customers, this article implies concrete choices regarding systems and processes. An HR system that automatically records sick leave must be secured both technically and organizationally in accordance with GDPR requirements. Consider access restrictions, encryption, and logs that track who had access and when. When conducting website development or web application development, you must take these restrictions into account from the design phase onward. Do not store unnecessary data, limit access to only those employees who need it, and document why you are collecting certain data. In our projects with small and medium-sized business (SMB) clients, we’ve noticed that the combination of an ecommerce store and a customer portal in particular poses risks: an order history for supplements or medications can already constitute health data, even if you don’t explicitly request it.

In practice, you’ll encounter Article 9 of the GDPR as soon as you work with sensitive information. This can range from an online intake form for a physical therapist to personnel files containing health data. For many small and medium-sized business owners, it’s not immediately clear when these stricter rules apply. Below, you’ll find specific situations in which you’ll deal with special categories of personal data and the legal basis you’ll need in those cases.

Health information in intake and contact forms

A physical therapist, dentist, or psychologist often collects health information via a website through an intake form. This includes symptoms, medication use, or previous treatments. As soon as you store this data, you are processing special categories of personal data. You then need explicit consent or must rely on the exception for medical research or treatment. In practice, this means you must include a separate checkbox in which the patient gives consent for the processing of health data, distinct from the general terms and conditions. You must also demonstrate that the data is stored securely, for example, using an SSL certificate and an encrypted database. Many web design agencies overlook this step, resulting in a website that is not GDPR-compliant from the moment it launches.

Employee files with special categories

As an employer, you sometimes collect data on employees’ union membership, religion, or health. Examples include sick leave, return-to-work programs, or leave requests for religious holidays. This data falls under Article 9 of the GDPR and may only be processed if there is a legal obligation, such as the Dutch Gatekeeper Improvement Act, or if the employee has given explicit consent. In an HR system, you must therefore set up separate access rights so that only HR staff can access this data. A common mistake is granting managers default access to complete employee files, including medical information. This is not permitted without a clear need and consent. With a custom-built web application for HR, you can configure these permissions in greater detail.

Member registration for associations and foundations

A sports club, religious organization, or political party often processes data regarding members’ religion, beliefs, or health. At a soccer club, for example, you record injuries or medical limitations. In a religious organization, you by definition record religious beliefs. Article 9 of the GDPR provides an exception here: associations with a philosophical or political purpose may process this data without explicit consent, provided it concerns their own members and the data is not disclosed to the public. However, as an association, you must still maintain a record of processing activities and secure the data. A membership system that runs on a shared Excel spreadsheet in Dropbox does not meet security requirements. Opt for a membership management system with role-based access and logging, or implement a GDPR-compliant CRM.

When Article 9 AVG is the right choice and when it is not

You need to rely on Article 9 of the GDPR as soon as you process data that falls under the nine special categories. Examples include an online questionnaire in which you ask about ethnicity, health, or sexual orientation. If you can avoid this question, do so. For example, ask only about relevant functional limitations instead of a complete medical history. If you truly need the data, ensure you obtain explicit consent and have a clear legal basis. Article 9 of the GDPR does not apply to general contact information, purchase history, or browsing behavior. For that data, the standard rules of the GDPR are sufficient. If you’re unsure whether a piece of data is special, consult the explanation provided by the Dutch Data Protection Authority.