Some personal data deserves reinforced protection, because misusing it can cause discrimination or serious harm. The GDPR treats it under stricter rules.
Special categories of data (Article 9 of the GDPR)
This is data revealing:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data and biometric data used to identify a person uniquely;
- health data;
- data concerning a person's sex life or sexual orientation.
The rule is a prohibition on processing. There are exceptions in Article 9(2), for example explicit consent, compliance with obligations under employment and social security law, occupational medicine or the defence of a right in legal proceedings. Anyone who has no applicable exception may not process this data.
Data on criminal convictions and offences (Article 10) is also under strict rules: it is processed only under the control of a public authority or where the law allows.
Health data
Lei n.º 58/2019 adds, in Article 29:
- access is governed by the need-to-know principle;
- processing must be carried out by a professional bound by professional secrecy or by another person bound by a duty of confidentiality;
- workers and service providers of the controller, and the DPO, who have access to health data are bound by a duty of secrecy.
In an ordinary company, the employer does not need to know anyone's diagnosis. The Código do Trabalho (Article 17) says that information about health or pregnancy may be requested only where the requirements of the activity justify it, with reasons given in writing, and that it is given to a doctor, who tells the employer only whether the worker is or is not fit. Article 19 prohibits, in any circumstances, requiring pregnancy tests or examinations.
In practice:
- an absence sheet shared with the team must not state the illness;
- a medical certificate is for justifying the absence, not for showing to colleagues;
- the question "what is wrong with our colleague?" has no answer to give.
Private life
Article 16 of the Código do Trabalho obliges employer and worker to respect the privacy of private life. This covers access to and disclosure of aspects of family, emotional and sex life, state of health and political and religious beliefs.
Identification numbers
The tax number (NIF), the Social Security identification number (NISS), the health service user number (SNS) and the citizen card number are personal data that identify someone beyond doubt. They link the person to many records and, in the wrong hands, allow fraud and identity theft. Lei n.º 58/2019 has no article of its own on them. The general rules apply:
- ask for and use the number only where there is a purpose and a basis for it;
- do not write it on lists visible to everyone, in unprotected emails or on screens facing the public;
- do not keep it longer than necessary.
Photographs and images
A photograph of a colleague or a customer is personal data. Publishing it on social media, on a poster or on the company website requires a lawful basis, normally consent, and clear information about the use.
Summary: special category data and identification numbers call for more care. Only those who need to should see them, and never "just out of curiosity".