All information related to an individual and which can be used to identify them is subject to data protection laws.
What is personal data?
Personal data is any information that can be used to identify an individual, such as:
name
national identification number
image
location data
or other information that can be linked to an individual. Information must be sufficiently accurate to make it possible to understand who they belong to.
All information related to an individual and which can be used to identify him or her is subject to data protection laws.
Combination of information
A collection of information that together results in information that applies only to you may be personal information.
A survey, where no information about the participants is collected except information about age and gender, is generally not considered to include the collection of personal information.
If the group that participates in the survey is composed in such a way that very few persons are of a certain age or of a certain gender, it may be personal data.
In such circumstances, it may be possible to know who answered, based on information about the person's age and gender.
Sensitive information
There is a stronger legal protection for sensitive information, such as:
race and ethnicity
political, and religious views
membership of a trade union
health information
information about sex or sexual orientation
genetics
biometrics, such as picture or fingerprints when used for identification
In principle, processing sensitive personal information is prohibited, but there are some exceptions.
Sensitive personal information may be processed without consent if the individual has clearly disclosed the information in advance.
In addition, sensitive personal data may be processed if it is necessary for:
obligations of the responsible party so that you can exercise certain rights under labor law, social security legislation or social protection legislation.
your or another person's substantial interests, if they are physically unable or legally incompetent to give their consent.
the legitimate activities of an institution, association or other entity that does not operate for profit and has political, philosophical, religious or trade union objectives. Your personal information may not be passed on to others without your consent.
so that it is possible to establish, maintain or defend legal claims.
of significant public interest.
processing within the healthcare system, to prevent diseases or for occupational medicine.
processing that concerns the public interest in the field of public health, such as to protect against serious health threats that cross borders or to ensure the quality and safety of healthcare services and medicines or medical devices.
archival, scientific or historical research or for statistical purposes.
In order for sensitive information to be processed, the processing must be based on one of the permit of the Personal Protection Act and one of the above exceptions. In some cases, the responsible party has to take specific measures to protect the fundamental rights of individuals.
Information of a sensitive nature
Some information is sensitive, although it does not fall within the definition of sensitive information in the Data Protection Act, such as:
social status
financial situation
marital status
child protection
Information relating criminal convictions and offences
Information on criminal behaviour of individuals is not considered sensitive information. However, there are special security measures regarding the processing of such information.
The government may only share information about criminal behavior if it is necessary due to their legal obligations. The government may not pass on such information unless:
the individual has given his unequivocal consent to the communication
sharing is necessary due to the legitimate interests of the public or private sector which clearly outweigh the interests of the individual in keeping the information confidential
communication is necessary due to the statutory tasks of the relevant government authority or in order to make an administrative decision
the communication is necessary for a project in the interest of the public sector that has been legitimately entrusted to a private party
Private organizations and parties can work with information about criminal behavior if the individual has given his unequivocal consent to it. In addition, processing may take place if it is necessary to protect a legitimate interest that clearly outweighs the individual's interest in keeping the information secret. Private parties may pass on such information without consent if it is done to protect public or private interests, including consideration of the person concerned, which obviously outweighs the interests that justify secrecy.
