Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, catégories sensibles de données

Article 40 prohibits collecting or processing data revealing racial, ethnic or regional origin, filiation, political opinion, religious or philosophical belief, trade union membership, sexual life, genetic data, or health, and article 41 lifts that prohibition only where the person has made the data public, given written consent, needs the processing to protect a vital interest they cannot otherwise consent to, needs it for a legal claim, an open judicial or criminal proceeding, a public interest historical, statistical or scientific motive, a contract, a legal obligation, a public mission, or the internal activity of a nonprofit body with a political, philosophical, religious or trade union purpose.

Article 42 restricts processing data on offences, criminal convictions or security measures to courts, public authorities and public service bodies acting within their legal remit, and to legal auxiliaries strictly for the missions the law assigns them.

Article 43 makes processing health data lawful only on one of eight listed grounds, including the person's consent, data they have made public, protecting vital interests, a legal purpose, public health promotion including screening, preventing a real danger or a specific offence, a legal claim, or preventive medicine and care under a health professional bound by professional secrecy.

Article 44 requires health data to be collected from the person themselves unless collecting it elsewhere is necessary for the processing or the person cannot supply it themselves. Article 20 also requires the CDP's prior authorization before processing genetic data or health related research data, data on offences, convictions or security measures, or biometric data, so these categories carry a registration burden on top of article 40's prohibition and article 42's restriction.