Special Category Data (GDPR)
Special category data refers to particularly sensitive personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, health data, or data concerning a person's sex life or sexual orientation. Under the GDPR, this type of data receives extra protection because processing it poses higher risks to people's fundamental rights and freedoms.
Legal Basis
"Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."
— Article 9(1), Regulation (EU) 2016/679 (GDPR)
The GDPR sets out strict conditions under which special category data may be processed, including explicit consent, substantial public interest, or other limited exceptions outlined in Article 9(2).
Why It Matters
Special category data is particularly relevant in the context of political advertising because political opinions are explicitly listed as a special category. When platforms, political parties, or advertisers process data revealing someone's political views—whether through direct collection or inference—they must comply with stricter GDPR requirements than for ordinary personal data.
For providers of political advertising services, this means you cannot use special category data for targeting or ad delivery unless you meet one of the narrow legal exceptions. The most common exception is explicit consent, but this must be freely given, specific, informed, and unambiguous. Simply accepting terms and conditions is typically not sufficient for special category data.
Under the Regulation on Political Advertising (EU 2024/900), the use of special category data for targeting political advertising is subject to additional restrictions beyond the GDPR. This creates a layered compliance obligation: first, you must have a valid GDPR legal basis, and second, you must comply with the political advertising regulation's targeting rules.
Key Points
- Eight categories: Special category data includes racial/ethnic origin, political opinions, religion, trade union membership, genetics, biometrics (for ID), health, and sex life/sexual orientation
- Processing generally prohibited: Article 9(1) GDPR creates a default ban on processing special category data, with limited exceptions in Article 9(2)
- Explicit consent required: When consent is the legal basis, it must be explicit—meaning a clear, affirmative action, not just implied or passive acceptance
- Political advertising restrictions: Using special category data (especially political opinions) for targeting ads faces both GDPR limitations and additional rules under Regulation 2024/900
- Higher penalties: Violations involving special category data can result in administrative fines up to €20 million or 4% of global annual turnover, whichever is higher
- Inference counts: Data you infer or derive about someone (like political opinions based on browsing behavior) is treated the same as data they directly provided
Special Category Data vs. Regular Personal Data
While all personal data under the GDPR must be processed lawfully, fairly, and transparently, special category data requires meeting a higher standard. Regular personal data (like name, email, or address) can be processed under six legal bases including legitimate interests. Special category data has a stricter regime: processing is prohibited by default and permitted only under specific Article 9(2) exceptions.
| Aspect | Regular Personal Data | Special Category Data |
|---|---|---|
| Legal bases | Six options (Article 6) | Must meet Article 6 AND Article 9 |
| Default position | Permitted if lawful basis exists | Prohibited unless exception applies |
| Consent requirement | Can be regular consent | Must be explicit consent |
| Typical examples | Name, email, location | Political opinions, health, biometrics |
| Risk level | Standard | Higher risk to rights and freedoms |
In political advertising, this distinction matters because inferring political opinions from online behavior immediately elevates the data to special category status, even if the original data points were regular personal data.