Health data, identity theft and fraud are among the most significant concerns of data protection, especially where sensitive personal data is concerned. Now the Information Commissioners Office has published detailed guidance on how data controllers should protect and handle this ‘Special Category’ data.
Special category data
Known as the most sensitive category of personal data, special category data concerns information on a person’s:
- health
- sex life or sexual orientation
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- membership to a trade union
- genetic data
- biometric data for uniquely identifying a person such as a fingerprint, or facial recognition
Special care must be taken when processing sensitive data. Because of its sensitive nature, there is a high risk to individuals if such data were to fall into the wrong hands. It is illegal to process any of the above categories of data without a specific reason.
So, data controllers MUST select one of the following legal grounds before processing:
- explicit consent
- obligations in employment
- social security and social protection law
- to protect vital interests
- processing by non-for-profit bodies
- manifestly made public
- establish, exercise or defend legal claims
- substantial public interest
- preventative or occupational medicine
- public health
- research purposes.
‘Special Category’ data must also be given extra levels of security to protect it. For example, limiting the number of individuals who may access such data, minimising the amount of data collected, stronger access controls – these and other such measures help protect the privacy of the individual, and to maintain the integrity and confidentiality of the data.
If you have any questions about data protection, please contact us via email team@datacompliant.co.uk or call 01787 277742
Gareth Evans, 15th November 2019