Besondere Kategorien personenbezogener Daten (Art. 9 DSGVO)

Health data in the personnel file, biometric templates in the access system, religious affiliation in payroll: many companies store sensitive data without consciously planning to. The GDPR places it under special protection. This also applies once the devices holding this data are retired.

What does Art. 9 GDPR say?

Art. 9(1) GDPR lists the special categories exhaustively. They are considered so sensitive that their disclosure can harm people considerably, for example through discrimination.

Category	Example in the company
Racial and ethnic origin	Information in application documents
Political opinions	Party membership in personnel files
Religious or philosophical beliefs	Denomination for church tax
Trade union membership	Deduction of dues via payroll
Genetic data	Findings in laboratory or physician systems
Biometric data for unique identification	Fingerprint templates in the time recording or access system
Health data	Medical certificates of incapacity for work, occupational physician records
Sex life or sexual orientation	Information in counseling or case files

Data on criminal convictions are not a special category within the meaning of Art. 9. The separate rule of Art. 10 GDPR applies to them, which however also requires strict protection.

When is processing permitted?

Art. 9(2) GDPR names exceptions to the prohibition. Of particular importance for companies are explicit consent, obligations under employment and social law, purposes of preventive health care and occupational medicine, and the establishment of legal claims. In Germany, § 22 BDSG adds further permissions and expressly requires appropriate safeguards.

What does this mean for retired IT?

Protection does not end with the use of a device. As long as the data resides on the data carrier, the controller must secure it appropriately under Art. 32 GDPR. For special categories, the protection need is generally high. This affects:

• Choice of method: Only erasure methods with verification or physical destruction come into question.
• Logistics: Sealed containers and documented handovers reduce the risk of loss.
• Evidence: Erasure or destruction certificates per serial number prove accountability.
• Service provider: A data processing agreement under Art. 28 GDPR regulates instructions and protective measures.

You clarify how high the protection need is in a Protection requirement assessment. If data carriers with health data are lost, a notification to the supervisory authority is almost always necessary, often also notification of the data subjects. For doctors, law firms and insurers, additionally the professional secrecy under § 203 StGB.

Special categories at Second IT

Second IT collects data carriers with its own secure logistics, checks all devices for storage media at goods receipt and registers them by serial number. Erasure is carried out with Blancco, with a digitally signed erasure certificate for each device. What cannot be erased is destroyed in-house according to DIN 66399 (up to H-5 and E-5). More on the data security measures and in the guide Disposing of data carriers in GDPR-compliant fashion. This entry does not replace legal advice.

Frequently asked questions about Art. 9 GDPR

Are sick notes special categories of personal data?

Yes. Medical certificates of incapacity for work contain health data within the meaning of Art. 9 GDPR, even if no diagnosis is stated. Systems and data carriers on which they are stored therefore have a high protection need.

Is a photo biometric data?

Not automatically. A photo only becomes biometric data under Art. 9 when it is processed with special technology to uniquely identify a person, for example in facial recognition.

Is erasure enough, or must such data carriers be destroyed?

The GDPR does not prescribe a particular method. A tested erasure method with documentation per data carrier can be sufficient. If a data carrier cannot be erased securely, for example because of a defect, destruction is the right way.

Does data on criminal offenses fall under Art. 9 GDPR?

No. Data on criminal convictions are not a special category within the meaning of Art. 9. The separate rule of Art. 10 GDPR applies to them, which also requires strict protection. You should therefore treat data carriers with such information just as carefully.

Do I have to report the loss of a data carrier with health data?

Almost always yes. If data carriers with health data are lost, a notification to the supervisory authority is generally necessary. Often the data subjects must also be notified. Sealed containers and documented handovers reduce the risk of loss.