The assessment of whether the criteria set out in Article 7 (a) - (f) have been fulfilled, is in all cases, initially made by the data controller, subject to applicable law and guidance on how the law should be applied. In the second instance, the legitimacy of the processing may be subject to further evaluation, and may possibly be challenged, by data subjects, other stakeholders, the data protection authorities, and ultimately decided on by the courts. To complete this brief overview, it should be mentioned that, as will be discussed in Section III.3.6, at least in the cases referred to in paragraphs (e) and (f), the data subject can exercise the right to object as provided for in Article 1429. This will trigger a new evaluation of the interests at stake, or, in the case of direct marketing (Article 14(b)), will require the controller to stop the processing of personal data without any further evaluation. III.1.2. Relationship with Article 8 Article 8 of the Directive regulates further the processing of certain special categories of personal data. It applies specifically to data ‘revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life’ (Article 8(1)), and to data ‘relating to offences or criminal convictions’ (Article 8(5)). The processing of such data is in principle prohibited, subject to some exceptions. Article 8(2) provides for a number of exceptions from such prohibition, under paragraphs (a) through (e). Article 8(3) and (4) provides for further exceptions. Some of these provisions are similar - but not identical – to the provisions set forth in Article 7(a) through (f). The specific conditions of Article 8, as well as the fact that some of the grounds listed in Article 7 resemble the conditions set forth in Article 8, raise the question of the relationship between the two provisions. If Article 8 is designed as a lex specialis, it should be considered whether it excludes the applicability of Article 7 altogether. If so, it would mean that special categories of personal data can be processed without satisfying Article 7, provided one of the exceptions in Article 8 applies. It is, however, also possible that the relationship is more complex and Articles 7 and 8 should be applied cumulatively.30 Either way, it is clear that the policy objective is to provide additional protection for special categories of data. Therefore, the final outcome of the analysis should be equally clear: the application of Article 8, whether in itself or in a cumulative way with Article 7, aims at providing for a higher level of protection to special categories of data. In practice, while in some cases Article 8 brings stricter requirements - such as ‘explicit’ consent in Article 8(2)(a), compared to ‘unambiguous consent’ in Article 7 - this is not true 29
Further to Article 14(a), this right applies 'save where otherwise provided by national legislation'. For instance, in Sweden national law does not allow the possibility to object to a processing which is based on Article 7(e). 30 Since Article 8 is set up as a prohibition with exceptions, these exceptions may be seen as requirements, which only limit the scope of the prohibition but do not, in and of themselves, provide a sufficient legal ground for the processing. In this reading, the applicability of Article 8 exceptions does not exclude the applicability of the requirements in Article 7, and the two, when appropriate, must be applied cumulatively.
14
