Processing special-category data such as health: Under GDPR, which statement best describes the baseline rule

Health data is special-category data subject to a default Article 9 prohibition lifted only by a specific 9(2) condition with safeguards.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Health data may be processed under legitimate interests like any ordinary personal data, provided the app documents a formal, detailed balancing test in its internal records of processing activities.

   Almost plausible because legitimate interests works for ordinary data, but health data is a special category where legitimate interests is not an available Article 9 condition.
2. Processing special-category data such as health information is prohibited by default unless a specific Article 9(2) condition, such as explicit consent, applies with appropriate safeguards. ✓

   Correct: Art. 9 sets a general prohibition on special-category data that is lifted only when a specific 9(2) condition, such as explicit consent, is met with safeguards.
3. Health data can always be processed after simple pseudonymization, which removes it from the special-category regime and lets the app rely on ordinary lawful bases going forward.

   Plausible-sounding but pseudonymized data can still be personal and special-category, so pseudonymization does not by itself lift the Article 9 prohibition.
4. Special-category rules apply only to biometric data used for identification, so self-reported health information sits entirely outside the Article 9 protections and its conditions.

   Plausible but Article 9 expressly covers health data alongside biometrics, so self-reported health information is within the special-category regime.

How to remember it

Health data is special-category data subject to a default Article 9 prohibition lifted only by a specific 9(2) condition with safeguards.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• A Data Protection Impact Assessment: Under GDPR controller obligations, which step is required before →
• The research-only licence does not authorize commercial: Considering intellectual property law, which →
• Test the features for proxy discrimination: Considering nondiscrimination and adverse-action expectations →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →