Article 9 AVG

Article 9 of the GDPR regulates the processing of special categories of personal data under European privacy legislation. This data is particularly sensitive and may only be collected and used under strict conditions. Examples include health data, religious beliefs, biometric data and information about a person’s sexual orientation. For SME business owners working in human resources, healthcare or membership schemes, this article specifies what information you are and are not permitted to record.

Which data falls under Article 9 of the GDPR?

The article explicitly lists nine categories of special categories of personal data. These include racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership. Genetic data, biometric data that uniquely identifies a person, health data and data relating to a person’s sexual behaviour or orientation are also included. This list is exhaustive, meaning that other data falls outside the scope of this article. In practice, we often see confusion among employers who believe that all staff data is special category data. This is not correct: a bank account number or telephone number falls under the general rules of the GDPR, not under Article 9. The key factor is sensitivity: could the data lead to discrimination or stigmatisation? If so, there is a good chance that it falls under Article 9.

When are you permitted to process special categories of personal data?

The main rule is simple: the processing of this data is prohibited. However, Article 9 sets out ten exceptions that do permit processing. The most important ones for small and medium-sized companies are: explicit consent from the data subject, necessity for employment law purposes (for example, recording sick leave), or a legal obligation. You may also use data that the data subject has made public themselves, subject to certain conditions. Please note: consent alone is often not enough. You must be able to demonstrate that the processing is both necessary and proportionate. A gym that asks about religious beliefs in order to draw up a training programme cannot substantiate that necessity. A healthcare organisation that records medication use for a treatment plan, however, can. The Dutch Data Protection Authority regularly publishes examples of permitted and prohibited processing.

How Article 9 of the GDPR affects business operations

For companies with staff or clients, this article implies specific choices regarding systems and processes. An HR system that automatically records sick leave must be secured both technically and organisationally in accordance with the requirements of the GDPR. Consider access restrictions, encryption and logs that track who had access and when. When developing a website or web application , you must take these restrictions into account right from the design stage. Do not store unnecessary data, restrict access to only those staff members who need it, and document why you are collecting certain data. In our work with SME clients, we have noticed that the combination of an online shop and a customer portal in particular poses risks: an order history for supplements or medicines may already constitute health data, even if you do not explicitly request it.

In practice, you’ll encounter Article 9 of the GDPR as soon as you work with sensitive information. This can range from an online intake form for a physiotherapist to staff files containing health data. For many SME entrepreneurs, it is not immediately clear when these stricter rules apply. Below, you can read about specific situations in which you will be dealing with special categories of personal data and what legal basis you will need in such cases.

Health data in intake and contact forms

A physiotherapist, dentist or psychologist often collects health information via a website in an intake form. This might include symptoms, medication use or previous treatments. As soon as you store this data, you are processing special categories of personal data. You will then need explicit consent or must rely on the exception for medical research or treatment. In practice, this means you must include a separate tick box in which the patient gives consent for the processing of health data, distinct from the general terms and conditions. You must also demonstrate that the data is stored securely, for example via an SSL certificate and an encrypted database. Many web design agencies overlook this step, meaning the website is not GDPR-compliant from the moment it goes live.

Personnel files containing special categories

As an employer, you may sometimes collect data on employees’ trade union membership, religion or health. Examples include sick leave, return-to-work programmes or requests for leave to observe religious holidays. This data falls under Article 9 of the GDPR and may only be processed if there is a legal obligation, such as the Dutch Gatekeeper Improvement Act, or if the employee has given explicit consent. In an HR system, you must therefore set up separate access rights so that only HR staff can access this data. A common mistake is for managers to be granted default access to full personnel files, including medical information. This is not permitted without a clear need and consent. With a bespoke HR web application, you can configure these rights in greater detail.

Member registration for associations and foundations

A sports club, religious organisation or political party often processes data relating to members’ religion, beliefs or health. At a football club, for example, you record injuries or medical conditions. In the case of a church organisation, you record religious beliefs by definition. Article 9 of the GDPR provides an exception here: organisations with a philosophical or political purpose may process this data without explicit consent, provided it concerns their own members and the data is not disclosed externally. Nevertheless, as an association, you must maintain a record of processing activities and secure the data. A membership system based on a shared Excel spreadsheet in Dropbox does not meet the security requirements. Opt for a membership management system with role-based access and logging, or implement a GDPR-compliant CRM.

When Article 9 AVG is the right choice and when it is not

You need Article 9 of the GDPR as soon as you process data falling under the nine special categories. Think of an online questionnaire in which you ask about ethnicity, health or sexual orientation. If you can avoid asking such questions, do so. For example, ask only about relevant functional limitations rather than a full medical history. If you really do need the data, ensure you obtain explicit consent and have a clear legal basis. Article 9 of the GDPR does not apply to general contact details, purchase history or browsing behaviour. For such data, the standard rules under the GDPR are sufficient. If you are unsure whether a piece of data is special category data, consult the guidance provided by the Dutch Data Protection Authority.