When is it possible to process sensitive personal data?
In order to be allowed to process sensitive personal data, the processing must be based on one of the six sources that can be seen in the answer to the question ,,When is it possible to process personal data?"
and
meet at least one of the following conditions:
You expressly consent to the processing for one or more specific purposes. The consent must be a non-compromising, specific, informed and unequivocal statement of intent that you agree to the processing of certain personal data for a specific purpose. More detailed information on the rules that apply to consent can be found in the answer to the question
The processing is necessary for you or the person who decides the processing (the responsible person) to fulfil their obligations and to exercise certain rights under labour law or social security or social protection legislation.
The processing is necessary to protect your or another person's substantial interests, who is not personally able to give his/her consent. It is not enough to refer to the fact that the person in question is abroad or is not familiar with the death, but he/she must be physically incapable or unfit by law to give his/her consent.
The processing is carried out as part of the legitimate activities of an institution, association or other non-profit organization with political, philosophical, religious or trade union goals. Your personal data may not be disclosed to others without your consent.
The processing only includes information that you have obviously made public yourself
The process is necessary for the creation, establishment or defence of legal claims
The processing is necessary for reasons of significant public interest and has a special legal authority
The process is necessary for the prevention of diseases or for occupational medicine, to assess the worker's skills, to diagnose diseases and to provide care or treatment in the field of health or social services, as it is carried out by the employee of such services who is bound by confidentiality.
The processing is necessary for reasons of public interest in the field of public health, such as to protect against serious cross-border health threats or to ensure the quality and safety of healthcare and medicines or medical devices.
The processing is necessary for statistical, historical or scientific research, as the personal data protection is ensured by certain measures, as appropriate, in accordance with the laws on personal data protection and the processing of personal data.
The processing is necessary for the archiving of documents in the public interest and is carried out on the basis of a law that provides for appropriate and specific measures to protect your fundamental rights and interests, in particular the confidentiality.
You can contact the Data Protection Authority if there is doubt as to whether or not certain personal data are sensitive and the agency will then resolve any disputes thereabouts.
