Data Protection Directive

Article 8

Untitled

The processing of special categories of data

1\. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

2\. Paragraph 1 shall not apply where:

(a) the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject's giving his consent; or

(b) processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law in so far as it is authorized by national law providing for adequate safeguards; or

(c) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consent; or

(d) processing is carried out in the course of its legitimate activities with appropriate guarantees by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subjects; or

(e) the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims.

3\. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.

4\. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.

5\. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.

Member States may provide that data relating to administrative sanctions or judgements in civil cases shall also be processed under the control of official authority.

6\. Derogations from paragraph 1 provided for in paragraphs 4 and 5 shall be notified to the Commission.

7\. Member States shall determine the conditions under which a national identification number or any other identifier of general application may be processed.

Holdings

C-708/1811 Dec 2019

TK v Asociaţia de Proprietari bloc M5A-ScaraA

Article 6(1)(c) and Article 7(f) of Directive 95/46, read in the light of Articles 7 and 8 of the Charter, do not preclude national provisions authorising the installation, without the data subjects' consent, of a video surveillance system in the common parts of a residential building for the legitimate interests of ensuring the safety and protection of individuals and property. That is so if the personal data processing carried out by means of that system satisfies the conditions in Article 7(f), which is for the referring court to determine.

C-362/146 Oct 2015

Maximillian Schrems v Data Protection Commissioner

A Commission adequacy decision under Article 25(6) of Directive 95/46, such as Decision 2000/520, does not prevent a Member State supervisory authority under Article 28 from examining a person's claim that a transfer of personal data relating to that person from a Member State to the third country concerned does not adequately protect that person's rights and freedoms, where the person argues that the third country's law and practice do not ensure an adequate level of protection.

C-141/1217 Jul 2014

YS v Minister voor Immigratie, Integratie en Asiel and Minister voor Immigratie, Integratie en Asiel v M and S

A residence-permit applicant has a right of access to all personal data concerning him that are processed by national administrative authorities within the meaning of Article 2(b) of Directive 95/46. That right is satisfied if the applicant receives a full summary of those data in an intelligible form, i.e. a form that lets him know the data and check that they are accurate and processed in compliance with the directive so that he can exercise the rights it gives him.

C-131/1213 May 2014

Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González

When assessing whether Article 12(b) and Article 14(a) apply, it must be examined, among other things, whether the data subject is entitled, at this point in time, to have the information no longer linked to his name by the list of results shown after a search on his name. That right does not depend on the inclusion of the information in the list causing prejudice to the data subject. As a rule, the data subject's rights under Articles 7 and 8 of the Charter override both the search engine operator's economic interest and the general public's interest in finding that information through a search on the data subject's name. But not where, for particular reasons such as the data subject's role in public life, the general public's preponderant interest in access to the information justifies the interference with those rights.

C-101/016 Nov 2003

Criminal proceedings against Bodil Lindqvist.

Stating that a person has injured her foot and is working half-time on medical grounds is personal data concerning health within the meaning of Article 8(1) of Directive 95/46.