The Court of Justice of the European Union (CJEU) decided in its judgment of 1 August 2022 (docket no. C-184/20) on the scope of special category personal data. The case concerned whether the name of a spouse or partner could be regarded as information concerning a person's sex life or sexual orientation. The CJEU stated that special category personal data must be interpreted widely and covers not only inherently sensitive data but also indirect sensitive data which requires an intellectual operation involving deduction or cross-referencing.
Conclusion: Due to the broad interpretation of special category personal data, a lot more processing activities might have to comply with the strict requirements under article 9 GDPR, particularly the consent requirement in article 9(2)(a) GDPR. However, because the CJEU has not defined the scope of indirect special category personal data, this decision leaves a lot of uncertainty.
IT and Data Protection Newsletter – Germany Summer 2022 edition | Perspectives | Reed Smith LLP
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.