Court of Justice of the EU (CJEU) decision in case C‑184/20 said that inferred special categories of data is indeed special categories of data as defined in the article 9 of the GDPR. The court case was brought forward by Lithuanian Commission of Ethics and is based on Lithuanian legislation that requires that people in public service must declare their public and private interests. The private interest part of the declaration requires publication of the name of a spouse and the Commission of Ethics argued that this could reveal information that can be interpreted as special categories of data as defined in the article 9 of the GDPR. Hereby its helpful that in Lithuanian last names clearly indicate the gender of a person, with the same name being spelled differently for males and females. The last name and also indicate the marital status of the females. Which means that indeed looking at the partner’s name would indicate very clearly the gender of the partner and thereby could reveal the sexual preferences of a public servant.
CJEU decided that indeed asking for partners name in the interest public and private declaration is revealing information that is special categories of data as defined in the article 9 of the GDPR. This is significant decision because CJEU said that data that are capable of revealing the sexual orientation of a natural person “by means of an intellectual operation involving comparison or deduction” are in fact special categories of data that the Controller must not process unless the GDPR article 9 exclusions apply. Basically the CJEU said that inferred special categories data, are indeed special categories data and this decision is valid to all types of special categories of data including for example health or union membership.
This CJEU’s decision has very wide repercussions across industries. For example e-chemists that put together profiles on their customers can infer data about their health situation or sexual preferences, internet retailers profiling their customers can also infer health conditions or sexual preferences all this is special categories data processing of which is forbidden. There is an infamous case of the US retailer Target that through profiling the shopping behaviour inferred teenagers pregnancy and revealed it to her parents before she could tell them – a data processing that would be forbidden according to the Courts decision.
The inferred special categories of data processing examples are not limited to the above and underlines yet again how important under the GDPR it is to know what data do you process, do you profile, what do you profile, what is the purpose of processing and of course what is the lawful base.
