Processing of special categories of personal data
Sec. 22(1) no. 1 BDSG allows the processing of special categories of personal data despite Art. 9 (1) GDPR, if it is necessary
- to exercise the rights derived from the right of social security and social protection
- for the purposes of preventive medicine, assessment of the working capacity of the employee, medical diagnosis, provision or treatment of health or social care, management of health or social care services, and if such data is processed by health professionals (or other persons subjected to professional secrecy obligation)
- for reasons of public interest in the area of public health
Employment
Processing of special categories of personal data is also permitted in an employment context. For more details, see “Data protection for employees”.
Derogations for public bodies
In accordance with Sec. 22(1) no. 2 BDSG, public bodies can process the special categories of data, when the processing is necessary:
- for reasons of substantial public interest
- to prevent a substantial threat to public security
- to prevent harm to the common good or to safeguard concerns of the common good
for urgent reasons of defence or supra- or intergovernmental obligations of a public body in case of conflict management or humanitarian measures
