Rättskällor med officiella primärkällor

Utskrivet ·

Skip to main content
Skip to the answer

Back to the act

EU regulatory register · GDPR

Article 9Processing of special categories of personal data

CELEX 32016R0679 · Read on 2026-08-18 · Chapter II

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

2. Paragraph 1 shall not apply if one of the following applies:

(a)

the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b)

processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

(c)

processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

(d)

processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

(e)

processing relates to personal data which are manifestly made public by the data subject;

(f)

processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

The article continues in the official text.

Open the article on EUR-Lex

Other articles in this chapter

Related articles

Articles in other acts connected to this one, with the reason written against the text. The map is a route between acts, not an assessment.

  • Depends on · incomingAI Act · 10

    The article on data and data governance leans on the exception for special categories of personal data where such data are needed to detect and correct bias.

    CELEX 32024R1689 · 2026-08-18

Decisions applying this article

Court, citation and the paragraphs of the reasons where the article is dealt with.

Judgments of the Court of Justice

4 decisions

  • C-65/23Court of Justice of the European Union

    MK v K GmbH

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6(1) and Article 9(1) and (2) of that regulation – Processing on the basis of a collective agreement – Margin of discretion of the parties to the collective agreement as regards the necessity of the processing of personal data provided for by that agreement – Scope of judicial review.

  • C-21/23Court of Justice of the European Union

    ND v DR

    Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of the obligations laid down by that regulation – Standing to bring proceedings – Article 4(15) and Article 9(1) and (2) – Directive 95/46/EC – Article 8(1) and (2) – Concept of ‘data concerning health’ – Conditions for the processing of those data.

  • C-446/21Court of Justice of the European Union

    Maximilian Schrems v Meta Platforms Ireland Limited

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Online social networks – General terms of use relating to contracts concluded between a digital platform and a user – Personalised advertising – Article 5(1)(b) – Principle of purpose limitation – Article 5(1)(c) – Principle of data minimisation – Article 9(1) and (2) – Processing of special categories of personal data – Data concerning sexual orientation – Data which are made public by the data subject.

  • C-667/21Court of Justice of the European Union

    ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning health – Assessment of an employee’s working capacity – Health insurance medical service processing data concerning the health of its own employees – Conditions for such processing and whether permissible – Article 82(1) – Right to compensation and liability – Compensation for non-material damage – Compensatory function – Impact of negligence on the part of the data controller.

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Verifiable trust signals

  • Six fixed blocks, one source per line
  • No sentence written by a language model
  • Engine version and read date on every answer
  • No customer data, no documents, no advice
  • Model card and audit published under the EU AI Act

Model cardAudit