An HR system stores trade-union membership for workforce planning. Staff treat the field like a cafeteria preference. What is the correct GDPR characterisation?
Select an answer to reveal the explanation.
Short Explanation
Union membership is not the same as picking a sandwich. GDPR puts trade-union membership in the special-category bucket with other highly sensitive traits. Treating it like cafeteria trivia underplays the legal protection it gets.
Full Explanation
Trade-union membership is special-category personal data and attracts heightened protection under Article 9. HR systems that store membership for workforce planning must not treat the field like a cafeteria preference: processing is prohibited unless an Article 9 condition applies, in addition to an Article 6 lawful basis. It is not ordinary HR metadata with the same legal treatment as a preferred lunch option. A yes/no flag without the union’s name is not anonymous while it still reveals membership status about identifiable workers. Employment records are not excluded from the GDPR. Exam caveat: Article 9 expressly lists trade-union membership—boolean encoding does not erase special-category status. Operational check: restrict union-membership fields to authorised HR roles, document the Article 9 condition, and keep the data out of general workforce analytics dashboards. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.