In a recent judgment, the Court of Justice of the European Union (the CJEU) held that personal data from which sensitive information can be inferred may qualify as a “special” category of personal data under the GDPR. In particular, the CJEU held that the publication of the name of a person’s partner could indirectly disclose the person’s sexual orientation and therefore should be treated as a “special” category of personal data under Article 9 of the GDPR. Many data – alone or used together – is liable to disclose indirectly sensitive information, even if an organization avoids collecting sensitive categories of data as such. Therefore, data controllers will need to review whether their databases may infer special categories of data and may need to take measures to avoid this, or implement a proper legal basis for processing special categories of personal data. Please click on the link below to read our client alert on this CJEU judgment..
Read more
