Loi n° 2017-020, catégories sensibles de données

Article 12 prohibits collecting or processing data revealing racial, ethnic, linguistic or regional origin, filiation, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, and article 13 lifts that prohibition only on the ten grounds it lists, including data the person has made public, their written consent, a vital interest they cannot otherwise consent to, a legal claim, an open judicial or criminal proceeding, a public interest historical, statistical or scientific motive, a contract, a legal obligation, a public mission, or the internal activity of a nonprofit body with a political, philosophical, religious or trade union purpose.

Article 14 restricts processing data on offences, criminal convictions or security measures to courts, public authorities and public service bodies acting within their legal remit, and to legal auxiliaries strictly for the missions the law assigns them.

Article 15 makes processing health data lawful only on one of eight listed grounds, including the person's consent, data they have made public, protecting vital interests, a legal purpose, public health promotion such as screening, preventing a certain danger or a specific offence, a legal claim, or preventive medicine and care.

Article 16 requires health data to be collected from the person themselves unless collecting it elsewhere is necessary for the processing or the person cannot supply it themselves. Article 37 also requires the Authority's prior authorization before processing genetic data or health related research data, data on offences, convictions or security measures, or biometric data, so these categories carry a registration burden on top of article 12's prohibition and article 14's restriction.