What is special category data?

This article explains what special category data is and the extra care required if you’re an organisation that handles such data. Personal data is at the heart of the GDPR, however, many are still unsure of what ‘personal data’ is. So let’s dive in.

What is ‘personal data’?

Personal data is information that relates to an identified or identifiable individual. As a result, if it is possible to identify an individual directly from the information you are processing, then that information may be personal data.

Common examples of personal data include your name, address, location data and identification numbers, such as a passport or payroll number. Less obvious examples include CCTV images, telephone voice recordings and online identifiers such as an IP or MAC address.

That’s a vast amount of information, more so when you take into account just how much information is readily available from a person’s social media accounts.

Social media platforms may be the obvious culprits, but what about your handheld device? How much do you really know about the personal data you’ve shared unwittingly when downloading an app? Do you know what is being done with that information?

You’re not alone. For example, in a survey by Pew Research Center, they found that four out of five people surveyed, feel they have no control over the data collected about them. Read our latest blog on the data sharing code of practice here.

What is ‘special category data’?

Some types of personal data are more sensitive than others. These include information about criminal convictions and what are known as the special categories of personal data. This is classed as ‘special category data’. 

Special category data includes information revealing:

• Biometric data – such as facial recognition
• Genetic data
• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Health data
• Data relating to someone’s sexual orientation or sex life.

How is personal data collected?

Picture this common scenario: You were snowed under all week with work, and now doing the food shopping feels like a mammoth task. You visit the supermarket’s website on your phone to order your weekly shop, but you need to install another app to place the order. Then it pops up, the legalese, the permissions. You click “accept” over and over, just to get it done without a second thought. One of those things you most likely agreed to in your haste was the app’s privacy policies.

Before you panic, it’s worth being aware that we actually have a lot more control over our personal data than you think. We just need the knowledge to understand the information deep within those lengthy privacy policies.

Under the GDPR, a privacy notice should disclose information such as:

• The type of data collected
• Purposes of its use
• How the information is collected (e.g cookies)
• The validity of the privacy policy
• Possible policy changes and how you’ll be affected
• What control do you have over your data
• The security measures in place to protect your data
• Whether any third parties will have access to your data
• The people accountable for the company’s privacy practices and their contact information

“That seems straightforward enough” I hear you say. But the main challenge lies within understanding the “legalese”. Add to that, some policies are so long that they take time to read – as an example, Facebook’s privacy policy takes over 15 minutes to read through, which is fairly standard. How many people who own an account on Facebook have taken the time to read through its privacy agreements? We’re going to guess a small percentage compared to active users.

But thanks to certain requirements in the GDPR, privacy policies may be getting shorter and easier to read – for some tips, we lay out how to write a GDPR compliance privacy notice. We have published “What is an appropriate policy document and when is it needed?” which is helpful in understanding your compliance obligations when it comes to special category data and data relating to criminal convictions.

In recent years, TikTok has taken the social media world by storm, captivating millions of users with its short-form video content. However, the platform has faced increasing scrutiny regarding its data handling practices and its impact on children and teenagers. Read about the recent Tik Tok fine imposed by the Data Protection Commission (DPC).

Steps for handling personal data within your organisation

Securing personal data is a key GDPR obligation. As an organisation, you have a responsibility to ensure you handle personal and sensitive data securely and in line with best GDPR practices as the security standard requirements are higher. You can do this by ensuring you have good internal data protection awareness amongst your staff, and we advise at least yearly internal GDPR training. Learn more about our e-learning employee GDPR training course. 

Here are some top tips for your employees to get started:

• Always set strong passwords on systems used to process personal data and never, under any circumstances share your login details with a colleague or anyone else.
• Keep your desk clear and computer locked when out of the office or away from your desk. This includes locking papers containing personal data in a drawer or cabinet.
• If you are working with personal data in an open plan area, position yourself so people standing close by cannot see the information and do not leave paper copies on the printer or in public areas.
• Do not trust unexpected emails containing attachments or inviting you to click a download link, even if they look genuine. If there is any doubt, call the sender or your IT team.

Need help with your organisation’s data protection responsibilities?

Visit our page that marks Data Protection Day here. 

If you are trying to clarify whether you are at risk of a data breach, or want to discuss what your business needs in order to prevent a breach, we can help. Our highly qualified, expert consultants offer a wide range of data protection as a service solutions.