What personal data should I handle with care?

Special personal data

The following data are regarded as special personal data:

• Personal data revealing racial or ethnic origin;
• Personal data revealing political views;
• Personal data revealing religious or philosophical beliefs;
• Personal data revealing membership of a trade union/association;
• Genetic data;
• Biometric data for the unique identification of a person;
• Data about a person's health;
• Data relating to a person's sexual behavior or sexual orientation.

In principle, Special Personal Data may not be processed. However, the GDPR has a number of exceptions to this prohibition, which are mentioned in article 9:

• There is explicit consent of the person concerned;
• The processing is necessary in connection with a duty or law regulated by collective agreement or by law in the field of labor law and social security and social protection law;
• The processing is necessary in order to protect the vital interests of the data subject, unless the data subject is able to provide consent;
• The special personal data have apparently been made public by the data subject. However, the disclosure must be 'evident': for example, an announcement of a trade union membership on TV;
• The processing is necessary for instituting, exercising or substantiating a legal action;
• The processing is necessary for an important public interest laid down in a law. For example, the processing of data relating to race or ethnicity for identification purposes;
• The processing is necessary for preventive or (labor) medical purposes. Such as the assessment of work ability and/or the provision of health care. This processing is only permitted if this is stipulated by law or in a medical treatment agreement and only by professionals who have a legal professional confidentiality, such as doctors or psychologists;
• The processing is necessary for public health purposes, provided this is stipulated by law;
• The processing is necessary for scientific research that serves a public interest. This exception can only apply if requesting permission proves impossible or involves a disproportionate effort. There must also be safeguards in place to ensure that the privacy of the data subject is not disproportionately impaired. More information about this can be found in the Theme Policy Scientific Research.

Incidentally, in all cases, all other conditions for processing personal data must also be met (e.g. a valid processing basis, purpose limitation, etc.). There are also stricter requirements for the security of these personal data.

Sensitive personal data

In addition to the special personal data included in the AVG, the AVG also mentions sensitive personal data. This includes in any case:

• The citizen service number or foreigner's number (V-number);
• A copy of an identity document / residence permit;
• Personal data of minors;
• Data concerning functioning, both of employees and students.

More information on the processing of sensitive personal data can be found in chapter 4.4 of the Privacy and Personal Data Protection Policy.