A health clinic processes genetic data for diagnosis. Beyond identifying an Article 6 lawful basis, what additional GDPR condition is typically required?
Select an answer to reveal the explanation.
Short Explanation
Genetic data for diagnosis sit in the special-category bucket—Article 6 alone is not the whole ticket. You still need an Article 9 condition (for example health care / medical diagnosis pathways where they fit) on top of a lawful basis. Think of it as two locks on the same door.
Full Explanation
Genetic data are special-category personal data. Processing generally requires an Article 9 exception or condition—such as explicit consent or provision of health care under suitable safeguards—in addition to an Article 6 lawful basis. A health clinic processing genetic data for diagnosis must satisfy both layers: ordinary lawfulness plus a special-category gateway appropriate to clinical care.
Only a marketing consent checkbox is not adequate for genetic data used in diagnosis. Special-category data still require a lawful basis; a clinic logo on a form does not waive Article 6 or Article 9. Article 9 applies to identifiable special-category data—not only to anonymous statistics—and genetic data used in diagnosis are typically highly identifiable and sensitive.
Exam caveat: special category ⇒ Article 6 + Article 9 (two keys). Operational check: identify the Article 9 condition (e.g., health care/professional secrecy), minimise genetic fields, harden access controls, and update DPIA/TOM documentation. Civic and clinical genetic services should treat residents’ genomes as among the highest-trust data holdings, recording why marketing-style checkboxes alone were rejected as an unlawful shortcut.