A clinic labels allergy information and genetic markers as ordinary CRM fields. Which GDPR classification should privacy counsel apply?
Select an answer to reveal the explanation.
Short Explanation
CRM labels do not outrank the statute. Allergy details and genetic markers are classic special-category (sensitive) personal data under GDPR—health and genetics—so they get the stricter gate, not the “ordinary newsletter field” treatment.
Full Explanation
Article 9 GDPR lists special categories of personal data, including data concerning health and genetic data. Processing those categories is generally prohibited subject to specific conditions and exceptions. Treating them as ordinary CRM attributes understates the heightened regime. Special categories are an EU GDPR concept, not solely a US HIPAA construct, and payment-card PANs are not the Article 9 special-category list.