III.1.2. Relationship with Article 8

The assessment of whether the criteria set out in Article 7 (a) - (f) have been fulfilled, is in all cases, initially made by the data controller, subject to applicable law and guidance on how the law should be applied. In the second instance, the legitimacy of the processing may be subject to further evaluation, and may possibly be challenged, by data subjects, other stakeholders, the data protection authorities, and ultimately decided on by the courts.

To complete this brief overview, it should be mentioned that, as will be discussed in Section III.3.6, at least in the cases referred to in paragraphs (e) and (f), the data subject can exercise the right to object as provided for in Article 1429. This will trigger a new evaluation of the interests at stake, or, in the case of direct marketing (Article 14(b)), will require the controller to stop the processing of personal data without any further evaluation.

III.1.2. Relationship with Article 8

Article 8 of the Directive regulates further the processing of certain special categories of personal data. It applies specifically to data ‘revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life’ (Article 8(1)), and to data ‘relating to offences or criminal convictions’ (Article 8(5)).

The processing of such data is in principle prohibited, subject to some exceptions. Article 8(2) provides for a number of exceptions from such prohibition, under paragraphs (a) through (e). Article 8(3) and (4) provides for further exceptions. Some of these provisions are similar - but not identical – to the provisions set forth in Article 7(a) through (f).

The specific conditions of Article 8, as well as the fact that some of the grounds listed in Article 7 resemble the conditions set forth in Article 8, raise the question of the relationship between the two provisions.

If Article 8 is designed as a lex specialis, it should be considered whether it excludes the applicability of Article 7 altogether. If so, it would mean that special categories of personal data can be processed without satisfying Article 7, provided one of the exceptions in Article 8 applies. It is, however, also possible that the relationship is more complex and Articles 7 and 8 should be applied cumulatively.

30

Either way, it is clear that the policy objective is to provide additional protection for special categories of data. Therefore, the final outcome of the analysis should be equally clear: the application of Article 8, whether in itself or in a cumulative way with Article 7, aims at providing for a higher level of protection to special categories of data.

In practice, while in some cases Article 8 brings stricter requirements - such as ‘explicit’ consent in Article 8(2)(a), compared to ‘unambiguous consent’ in Article 7 - this is not true

29 Further to Article 14(a), this right applies 'save where otherwise provided by national legislation'. For instance, in Sweden national law does not allow the possibility to object to a processing which is based on Article 7(e). 30 Since Article 8 is set up as a prohibition with exceptions, these exceptions may be seen as requirements, which only limit the scope of the prohibition but do not, in and of themselves, provide a sufficient legal ground for the processing. In this reading, the applicability of Article 8 exceptions does not exclude the applicability of the requirements in Article 7, and the two, when appropriate, must be applied cumulatively.

for all provisions. Some exceptions foreseen by Article 8 do not appear equivalent or stricter than the grounds listed in Article 7. It would be inappropriate to conclude for instance that the fact that someone has made special categories of data manifestly public under Article 8(2)(e) would be - always and in and of itself - a sufficient condition to allow any type of data processing, without an assessment of the balance of interests and rights at stake as required in Article 7(f)31 .

In some situations, the fact that the data controller is a political party would also lift the prohibition on processing special categories of data under Article 8(2)(d). This, however, does not mean that any processing within the scope of that provision is necessarily lawful. This has to be assessed separately and the controller may have to demonstrate, for instance, that the data processing is necessary for the performance of a contract (Article 7(b)), or that its legitimate interest under Article 7(f) prevails. In this latter case, the balancing test under Article 7(f) needs to be conducted, after it has been assessed that the data controller complies with Article 8 requirements.

In a similar way, the mere fact that ‘the processing of data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services’, and those data are processed under an obligation of secrecy - all as mentioned in Article 8(3) - implies that such processing of sensitive data is exempted from the prohibition of Article 8(1). This is however not necessarily sufficient to also ensure lawfulness under Article 7, and will require a legal ground such as a contract with the patient under Article 7(b), a legal obligation under Article 7(c), performance of a task carried out in the public interest under Article 7(e) or an assessment under Article 7(f).

In conclusion, the Working Party considers that an analysis has to be made on a case-by-case basis whether Article 8 in itself provides for stricter and sufficient conditions32 , or whether a cumulative application of both Article 8 and 7 is required to ensure full protection of data subjects. In no case shall the result of the examination lead to a lower protection for special categories of data33 .

This also means that a controller processing special categories of data may never invoke solely a legal ground under Article 7 to legitimise a data processing activity. Where applicable, Article 7 will not prevail but always apply in a cumulative way with Article 8 to ensure that all relevant safeguards and measures are complied with. This will be all the more relevant in case Member States decide to add additional exemptions to those of Article 8, as foreseen in Article 8(4).

31 Moreover, Article 8(2)(e) should not be interpreted a contrario as meaning that, when the data made public by the data subject are not sensitive, they can be processed without any additional condition. Publicly available data are still personal data subject to data protection requirements, including compliance with Article 7, irrespective whether or not they are sensitive data. 32 See the analysis made in the WADA Opinion of the Working Party, point 3.3, which takes into consideration both Article 7 and Article 8 of the Directive: Second opinion 4/2009 on the World Anti-Doping Agency (WADA) International Standard for the Protection of Privacy and Personal Information, on related provisions of the WADA Code and on other privacy issues in the context of the fight against doping in sport by WADA and (national) anti-doping organizations, adopted on 06.04.2009 (WP162). 33 It goes without saying that also in the case of application of Article 8 the respect for the other provisions of the Directive, including Article 6, must be ensured.