EU court: data attributes revealing sensitive personal data can be ‘special category’ data

Publication of widely used personal data attributes, such as a person’s name, can reveal sensitive personal information about someone else and their disclosure can therefore be prohibited under EU data protection law, according to a new ruling. The Court of Justice of the EU (CJEU) ruled that any data capable of revealing sensitive personal data of an individual by means of an ‘intellectual processing operation’ – for example, comparison or deduction – falls within the umbrella of ‘special category’ personal data under article 9 of the General Data Protection Regulation (GDPR), to which strict data protection laws apply. In this case, the CJEU said it was possible to determine an individual’s sexual orientation through publication of the name of his spouse.Amsterdam-based data protection law expert Andre Walterof Pinsent Masons said the judgment highlights how important it is for organisations to consider the full context when determining whether it is lawful for personal data to be di...