Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Generally, the processing of special categories of personal data is prohibited, i.e. the processing limitation applies. Such data may only be processed based on a person’s consent or other exceptions provided in Article 9 (2) of the GDPR. There must also be a legal basis for processing.

Examples of the use of special categories of personal data in research

Special educational needs. When researchers want to study students’ special educational needs, it may be difficult for them to determine whether these are special categories of personal data. That is certainly the case when special educational needs arise from health reasons (for example, linked to a medical diagnosis or disability). When, however, the special needs are a talent or a communication or learning disability, they may not be related to the child’s health. In this case, it is not a special category of personal data. Nevertheless, special educational needs can be considered a more sensitive data category than usual, especially for children.

The final assessment depends on the specific data processing and its purpose. If the aim is just to make generalisations and the researcher is not interested the cause of the special need, it is not a special category of personal data. For example, if students A and B in one class allegedly have (an unspecified) special educational need, but students C, D, and E do not, the fact of the special need is taken as such, and it is not considered a special category. However, if the research focuses on the performance of pupils in connection with a specific and explicitly formulated special need (for example, how speech impairment affects learning motivation or what kind of support pupils with a physical disability need), it is processing special categories of personal data.

If researchers cannot fully control the amount of data collected (for example, the researcher does not know what the interviewee answers or what is written in response to an open-ended question), they may end up collecting special categories of personal data even if the original purpose was to investigate special needs (such as talent) that do not fall under the special categories. It is therefore advisable, as a precautionary measure, to treat all special educational needs as special categories of personal data, especially if it cannot be excluded that the research will also analyse the causes of the special needs. If it is known that this will not be done, it should be clearly stated in the survey plan and the information given to the respondents. Researchers can also formulate data collection questions in a way that does not encourage anyone to share health data.

Health indices. Indices and other complex measures that can be used to draw conclusions about a person’s health are considered health data. They should therefore be regarded as special categories of personal data, and the same applies to calculating the indices. For example, if the study aims to calculate a body mass index, associate it with a person and thereby obtain new information about the person’s health, the calculation of the index must be considered processing of a special category of personal data. Weight and height do not belong to special categories of personal data.

1.3.2. IP addresses

In its judgment, C-582/14 of 19 October 2016, the European Court of Justice ruled that dynamic IP addresses that change with each connection to the internet constitute personal data. This interpretation is based on the GDPR’s definition of personal data as “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly”.

The European Court of Justice notes that “a dynamic IP address does not constitute information relating to an ‘identified natural person’, since such an address does not directly reveal the identity of the natural person who owns the computer from which a website was accessed, or that of another person who might use that computer” (p. 38). However, an IP address makes it possible to identify a person indirectly. The European Court of Justice explains that all the information enabling the identification of the data subject does not have to be in the hands of one person (p. 43). That means that the internet service provider may be asked to provide additional data, after which it will be possible to identify the person.

In addition, it should be assessed how reasonable and likely the possibility of indirectly identifying an individual is when combining the different data. According to the court, it is, for example, reasonable and likely that an internet service provider will transfer its customer’s data to a competent authority (for example, in the case of cyberattacks) to protect the rights of individuals or comply with legal obligations. It is also possible that a person who knows the dynamic IP address of a potential infringer, in order to protect their rights or to comply with legal obligations, to take legal action before a court or other competent authority that can request the necessary data from the internet service provider to identify the infringer behind the IP address.

Reasonable and likely, therefore, include the possibility that a person is identified indirectly by several institutions or persons working together. An indirect identification is not reasonable and unlikely if it is prohibited by law or practically impossible and requires a disproportionate effort or cost (p. 46). Consequently, the researcher should be aware that if the respondent’s IP address is stored together with the data collected, for example, through an online survey or another online service, the respondent could be identifiable from the perspective of the data protection law. Various survey platforms allow researchers to configure the survey in such a way that the respondent’s IP address or other technical information, which would facilitate the respondent’s identification, is not collected (see 3.4.5).