A transport app stores precise disability status so staff can arrange boarding assistance. A product manager treats the field like any other preference checkbox. How should privacy counsel classify that data under the GDPR?
Select an answer to reveal the explanation.
Short Explanation
Think of disability status like a medical wristband on a passenger file—it is not a snack preference. When the app keeps precise health or disability details about a real rider, GDPR treats that as special-category personal data. Operational usefulness does not downgrade the sensitivity.
Full Explanation
Precise disability status used to arrange boarding assistance reveals health-related information about an identifiable person and is therefore special-category personal data under Article 9, not an ordinary preference checkbox. Transport-app product managers who treat the field like any other preference understate the heightened regime: processing is generally prohibited unless an Article 9(2) condition applies alongside an Article 6 basis. It is not ordinary contact data merely because boarding help is operational. Storing the disability label under an internal numeric code does not make it anonymous logistics metadata while the meaning remains linked to a natural person. Disability status is not confidential business data outside the GDPR. Exam caveat: health/disability information is Article 9 special-category data regardless of UX labelling as a preference. Operational check: gate disability fields behind need-to-know access, document the Article 9 condition for assistance arrangements, and exclude those fields from analytics and marketing exports. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion.