When can we use special category data in our ADM?

In detail

• What is special category data?
• What are the special category data conditions for ADM?
• When can we rely on the ‘explicit consent’ condition for ADM?
• When can we rely on the ‘contract’ condition for ADM?
• When can we rely on the ‘required or authorised by law’ condition for ADM?

What is special category data?

The UK GDPR singles out some types of personal information as likely to be more sensitive, and gives them extra protection. These are listed in article 9 as:

• personal data revealing racial or ethnic origin;
• personal data revealing political opinions;
• personal data revealing religious or philosophical beliefs;
• personal data revealing trade union membership;
• genetic data;
• biometric data (where used for unique identification purposes);
• data concerning health;
• data concerning a person’s sex life; and
• data concerning a person’s sexual orientation.

Special category data merits specific protection because using this information may create significant risks to people’s fundamental rights and freedoms. 

If you have inferred details, either correctly or incorrectly, about someone which fall into one of the above categories, this information may count as special category data. Whether inferred data counts as special category data depends on whether you intend to:

• make an inference linked to one of the special categories of data; or
• treat someone differently on the basis of inferred information linked to one of the special categories of data. 

If this is the case, you are processing special category data regardless of how confident you are that the inference is correct.

(For further information, see our detailed guidance on special category data under What about inferences?.)

ADM systems may aim to make predictions based on patterns within a population. In this sense, they may appear to only concern groups. However, if your system involves making inferences about a group by creating affinity groups and linking these to a specific person, data protection law applies at multiple stages of the processing. More specifically:

• the development stage, involving processing of people’s personal information to train a model or build a system; and
• the deployment stage, where you apply the results of the model or the system to people that were not necessarily part of the training dataset, on the basis of its predictive features.

What are the special category data conditions for ADM?

The ADM provisions allow you to base significant decisions entirely or partly on solely automated processing of special category data, but only in certain circumstances. Otherwise, using special category data is prohibited.

Importantly, this means you must comply with what the ADM provisions say, even if you use a small amount of special category data, including what is inferred. You must carefully assess whether you are processing any special category data.

You can only carry out ADM using special category data if you can rely on one of the following special category data conditions:

• explicit consent;
• contract; or
• required or authorised by law.

For the last two conditions, you must also identify a substantial public interest condition out of the 23 available. (For more information, see our detailed guidance on special category data under What are the substantial public interest conditions?.)

The special category data conditions are not the same as the lawful bases for processing under article 6. They are specifically about enabling ADM involving special category data. 

But there may be links between them. For example, if your article 6 lawful basis is contract, it is likely that your article 22B condition for ADM using special category data is contract. However, under article 22B, you must also identify a substantial public interest condition. 

When you identify your lawful basis, you should think about why you want to use the personal information. You should also consider which lawful basis best fits the circumstances, rather than selecting one because there is an article 22B condition you want to rely on. 

When you carry out ADM using special category data, you must also identify a relevant condition under article 9. Where your article 22B condition is that the decision is necessary for a contract or required or authorised by law, you must also ensure that the substantial public interest condition in article 9(2)(g) applies. This is therefore likely to be your article 9 condition for basing significant decisions entirely or partly on special category data, and you must identify an appropriate condition in schedule 1, part 2 of the DPA. 

However, you must ensure that the explicit consent is specific and informed. If you intend to rely on explicit consent under article 9, you must give people granular and specific information about how your processing involves ADM. This includes at least meaningful information about the logic involved and the envisaged consequences. If you don’t do this, you are unlikely to comply with the explicit consent condition under article 22B (or the article 9 requirements for explicit consent about that processing specifically). 

When can we rely on the ‘explicit consent’ condition for ADM?

You can use special category data to undertake ADM if the person the decision is about gives their explicit consent for you to do so. Explicit consent means that the person expressly confirms their consent. For example, by a written statement, filling in an electronic form or sending an email. 

Explicit consent is one of the conditions you can use to process special category data under article 9 of the UK GDPR. Because explicit consent likely requires more specific affirmation of agreement, meeting this standard generally also satisfies the requirements for using consent as a lawful basis for processing under article 6.

To meet the UK GDPR standard for consent under article 6, you must ensure it is: 

• freely given;
• specific;
• informed;
• unambiguous;
• demonstrated through a clear affirmative action; and
• capable of being withdrawn at any time. 

In addition, when relying on explicit consent under article 9, you must ensure that the person clearly and expressly confirms their agreement. This is likely to involve:

• specifying the type of special category data (eg health, biometric); and
• presenting this consent separately from any other consents you are seeking; and
• obtaining a clear statement of consent (whether oral or written).

When can we rely on the ‘contract’ condition for ADM? 

You can rely on the contract condition to carry out ADM using special category data, but only when the decision is genuinely necessary for the performance of a contract with the person.

This doesn’t mean the decision has to be absolutely essential for the contract. But you must ensure it is a targeted and proportionate way of meeting your contractual obligations, and that there are no other reasonable or less intrusive ways to achieve this outcome.

You should ask yourself:

• Would the contract be difficult or impossible to deliver without this ADM, or without this special category data?
• Is there a less privacy-impactful alternative that would still allow us to fulfil the contract?

The law recognises modern service chains. ADM may potentially be carried out by a different controller than the one who is party to the contract with the person. 

“the decision is—  

(i) necessary for entering into, or performing, a contract between the data subject and a controller…”

This is often relevant in outsourced decision-making, where the decision is still undertaken for the purposes of the contractual arrangement. When relying on contract for ADM based on special category data, you must also identify a substantial public interest condition out of the 23 available.  

When can we rely on the ‘required or authorised by law’ condition for ADM?

For something to be required or authorised by law, it isn’t necessary for there to be a piece of legislation that explicitly allows or requires ADM for a particular purpose. 

If you have a statutory or common law power to do something, and ADM is the most reasonable and proportionate way to achieve your purpose, you may be able to justify this type of processing as ‘authorised’ by law. 

However, you should document and be able to show that it’s reasonable for you to do so in all the circumstances.