DP News – Week 32. A wide interpretation of the term ‘special categories of personal data’. Or of the term ‘personal data’ in general?

On 01 August 2022, the Court of Justice of the EU (CJEU) issued a preliminary ruling, where it ended up with a broad interpretation of the term ‘special categories of personal data’ (case C-184/20).

The court came to the conclusion that the publication (in the case at issue – on the website of the public authority) of personal data related to the data subject’s spouse, cohabitee or partner may reveal sensitive information, ‘such as the fact that the data subject is cohabiting or is living with another person of the same sex’, thus resulting in ‘significant nuisance in the private life of those persons’. The publication of such data indirectly discloses the sexual orientation of a natural person and constitutes processing of special categories of personal data under Article 9(1) GDPR.

As the court explains, the indirect revelation of the sexual orientation may occur ‘by means of an intellectual operation involving comparison or deduction’.

Finally, the court concludes that the publication ‘of personal data that are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data’.

The CJEU’s position may be interpreted as solving the controversy between Norway’s supervisory authority (Datatilsynet) that supported a broad understanding of the notion of ‘special categories of personal data’ in the Grindr case, and Spain’s watchdog (AEPD) that, on the contrary, found that no special category of personal data was processed in the same situation.

The ruling might have far-reaching implications for multiple actors, e.g., online platforms targeting internet users and delivering to them behavioral ads; operators of GPS navigation services tracking car drivers and able to deduce, e.g., data on their religious beliefs from the places visited.

It also leaves much unclarity as to the objective (and measurable) limits of the ‘intellectual operations involving comparison or deduction’. Further, although the court leads the discussion in the context of ‘special categories of personal data’, similar ‘intellectual operations’ might logically be performed in respect of ‘general’ personal data, thus broadening the scope of the notion of ‘personal data’ even further. This looks quite logical, given that the GDPR provides a uniform definition of the notion of ‘personal data’, whether of ‘special categories’ or not.

With that said, the real (as opposed to anticipated) implications of the ruling will hopefully become clear for privacy practitioners in the months ahead.