Special Category Data: Getting It Right Under the UK GDPR

Most UK businesses handle special category data without realising. The moment you record a sickness absence, collect equal opportunities monitoring data, perform a DBS search, ask about dietary requirements for a staff event, or store information about an employee’s union membership, you are processing it. The UK GDPR places higher obligations on you than for ordinary standard category personal data, and the ICO’s guidance on special category data is the authoritative reference.

Standard category data

As you will know, if you wish to process standard category data, for example, a name and address, you must have a lawful basis under Article 6. However if you wish to process sensitive special category data you must have an additional lawful basis, referred to as a lawful condition, which is found under Article 9, this additional lawful condition is just for the additional sensitive information captured. I will return to this matter shortly.

What counts

Article 9 of the UK GDPR sets out eight categories that need extra protection:

•       Racial or ethnic origin
•       Political opinions
•       Religious or philosophical beliefs
•       Trade union membership
•       Genetic data
•       Biometric data, where used to uniquely identify someone
•       Data concerning health
•       Data concerning sex life or sexual orientation

In many situations a controller will capture special category data as a byproduct of the original purpose of processing. For example, CCTV or a photograph may reveal a person’s ethnicity or health condition, a name may signal a religious background, but it was not the controllers intention to identify or infer this information. In these cases no Article 9 condition would apply. 

Criminal offence data is a separate classification and sits under GDPR Article 10 with its own conditions, but for day to day purposes you would treat criminal offence data in the same way you would treat special category data, providing similar levels of protection.

The double-lock

As mentioned above, for ordinary personal data, you need at least one lawful basis from Article 6. For special category data, you need an additional Article 9 condition. The two operate together; an Article 6 lawful basis legitimises the processing of basic personal data, and Article an 9 condition permits the processing of more sensitive data. There are ten Article 9 conditions, the most commonly used being explicit consent, employment law obligations, substantial public interest, health or social care, and legal claims. Several of these come with extra requirements under Schedule 1 of the Data Protection Act 2018, meaning that you must specify which substantial public interest condition(s) you are relying upon. Where actual or alleged criminal offence data or records are processed an Appropriate Policy Document (APD) must be created. The APD clarifies the reason(s) for processing and additional safeguards the controller will put in place to safeguard this even more sensitive data. Many SMEs, especially those doing employee DBS searches neglect to have an APD in place.

Where it commonly goes wrong

•       Treating sickness data as ordinary HR data. A return-to-work form mentioning a specific condition is health data, and the safeguards need to match.
•       EDI monitoring without thinking through Article 9. Equality, diversity and inclusion data is a special category. Most employers can rely on substantial public interest, but it has to be documented.
•       Forgetting the Appropriate Policy Document. If you rely on the employment or substantial public interest condition, the absence of an APD is a soft target for the ICO.

• Lack of retention policy. Special category data should be deleted as soon as it is no longer required; for example, if you record dietary requirements for an event, that information should be deleted shortly after the event has finished. You might argue that you may want to keep it on file for the next event, but diets change and allergies develop and so surely you are going to ask again anyway, therefore why keep the information?

•       Holding DBS data longer than necessary. Criminal offence data should not sit in HR files indefinitely; tight retention and access controls are essential.

How Griffin House Consultancy Can Help

Special category data is the area where the gap between technical compliance and operational reality is widest. We help organisations map where it sits in their processing, identify the right Article 9 conditions, write Appropriate Policy Documents, and train HR, recruitment and operations teams on the day-to-day handling. Whether you need a one-off review or ongoing support tied to your record of processing activities, get in touch with us at Griffin House Consultancy, or call us on 01673 885533.

Author: Mike Martin LLM

Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.