Law on the Protection of Personal Data, sensitive data categories

Article 13 subjects the processing of sensitive data, defined as philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin, and health and sex life including genetic data, to a legal provision that permits it or to the APD's authorisation, which the APD may grant only where the data subject or their legal representative has given unequivocal, express and written consent, a nonprofit political, philosophical, religious or trade union body processes only its own members' or regular contacts' data with their consent, the data subject was physically or legally unable to consent and processing protects vital interests, the data subject has manifestly made the data public, the processing serves the establishment, exercise or defence of a right in judicial proceedings, or the processing is indispensable to a public authority's legal or statutory functions including judicial, police or administrative investigation.

Article 13 further requires sensitive data processed under a legal provision to be notified to the APD and carried out with guarantees of non-discrimination and special security measures.

Article 14 permits processing of health and sex-life data, including genetic data, only with the data subject's or their legal representative's unequivocal, express and written consent or the APD's authorisation, unless the processing serves preventive medicine, medical diagnosis, consented medical care, health-service management or statistics, a medical emergency, or the public interest, and only through a health professional bound by professional secrecy.

Article 15 permits processing of data on persons suspected of illicit activities, criminal offences, contraventions, and applicable penalties, security measures, fines or accessory sanctions only by a public authority, under a legal provision cleared with the APD's prior opinion or under the APD's own authorisation, and limits processing for police investigation purposes to what a determined offence's prevention or repression requires.

Article 17 subjects the installation of video surveillance systems and other means of capturing, processing and disseminating sound and images that permit identifying people, including electronic road surveillance systems, to Article 13's regime, and requires the controller to post notice at any location carrying such a system of its existence, of the capture of sound and image, and of the controller's name, address, phone number and email.