Sensitive personal data is a closed list in GDPR Article 9. It covers information about racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health, and sex life or sexual orientation. Everything else is, in the legal sense, ordinary personal data.
That surprises many people, because the list fits poorly with what people themselves regard as private. Salary is not on it. Neither is the national ID number. Both still need special protection, which is why Danish practice works with more than two categories.
The categories in practice
| Category | What belongs here | Rules |
|---|---|---|
| Ordinary personal data | Name, address, phone number, email, job title, date of birth, photo, customer number | GDPR Article 6 |
| Confidential information | National ID (CPR) number, salary, finances and debt, family matters, employment matters such as warnings and dismissals | Ordinary data that requires extra protection. CPR numbers have their own rules in section 11 of the Danish Data Protection Act |
| Sensitive personal data | The special categories listed in Article 9 | Prohibited as a starting point. Requires an exception in Article 9 on top of the basis in Article 6 |
| Criminal offences | Convictions, charges, criminal records | GDPR Article 10 and section 8 of the Danish Data Protection Act |
The Danish Data Protection Agency goes through the categories under Basic concepts (in Danish), and the legal text is in the General Data Protection Regulation.
The everyday Danish word “personfølsom” does not appear in the law. It usually covers a mix of confidential and sensitive information. That is fine as everyday language, as long as employees know that the two groups have different rules.
Ordinary personal data is still protected
Calling the data “ordinary” can give the impression that the information is freely available. It is not. A customer’s email address may only be used for the purpose it was collected for, it has to be deleted when the purpose has been fulfilled, and a list of 4,000 email addresses sent to the wrong recipient is a personal data breach.
The difference lies in how much it takes to process the data lawfully, and how strongly it has to be protected.
Where does the national ID number belong?
No piece of information raises more questions than the CPR number. Under the GDPR it is ordinary personal data. In Denmark it has its own rules and is regarded as confidential.
Private companies may only process CPR numbers when it follows from legislation, when the person has consented, or when one of the other conditions in the Danish Data Protection Act is met. An employer needs it to report salaries to the tax authorities, so the basis is in place. A webshop asking for a CPR number to create a customer profile rarely has one.
For employees, three rules are enough:
- Only ask for a CPR number when there is a clear reason, and use another ID if that does the job.
- Never send it in an ordinary, unencrypted email. The Danish Data Protection Agency requires encryption when confidential and sensitive information is sent over the internet.
- Do not put it in subject lines, file names or free-text fields where more people than necessary can see it.
Sensitive information you may not have known you had
Few companies outside the health sector see themselves as processing sensitive information. Most do anyway.
In HR. A sick note with a diagnosis is health information. So is a note that an employee is pregnant, or an agreement on lighter duties after an operation. The fact that an employee is off sick, with no reason given, is normally not regarded as health information.
In the payroll system. If trade union dues are deducted from salary, the membership appears on the payslip. That is sensitive information.
In the canteen and at events. A sign-up list saying “gluten allergy” or “does not eat pork” can reveal health or religion.
In access control. Fingerprints or facial recognition used to unlock a door are biometric data.
In customer dialogue. A customer who explains a late payment in an email by mentioning a hospital stay has given you health information you did not ask for. It still has to be handled correctly.
A name can become sensitive through context as well. A list of members of a patient association contains only names and addresses, but it says something about health.
What does Article 9 require of you?
Article 9 starts from a prohibition. To process sensitive information, you need a basis in Article 6 and, in addition, one of the exceptions in Article 9(2). The most used are explicit consent, obligations under employment law, and processing necessary to establish or defend a legal claim. We describe the general bases in the article on when you may process personal data under GDPR.
Day to day, this means stricter requirements all round: fewer people with access, encryption when sending, shorter storage and greater care about where the information is written down. When things go wrong, it weighs more heavily too. A breach involving sensitive information more often has to be reported to the data protection authority, and those affected more often have to be told.
A test employees can use
When an employee is holding a piece of information and is unsure, three questions help:
- Can the information be linked to a specific person? If yes, it is personal data.
- Is it about health, trade union membership, religion, politics, ethnicity, sexuality, biometrics or genetics? If yes, it is sensitive.
- Would the person expect it to be kept within a narrow circle, as with salary, national ID number, debt or a warning? If yes, it is confidential.
If the answer to 2 or 3 is yes, the strict rules apply: access only for those who need the information, secure transmission, and deletion when the purpose has been fulfilled.
Make the difference recognisable
Learning the categories is easy. Using them when the inbox is full is harder. Employees remember them best when they have seen them in their own workflows: the receptionist with the guest list, the manager with the absence interview, the customer service agent with the email about the hospital stay.
In our GDPR training, employees work with that kind of situation. The content is developed together with specialists in data protection law, and the scenarios can be adapted to the information your organisation actually processes. In the AP Pension case you can see how the course was rolled out in role-based versions as a shared baseline for everyone who works with personal data.
