Enhanced protection for ‘special data’ Clause Samples

Enhanced protection for ‘special data’. The notion of special categories of personal data is broadly interpreted by the CJEU. It ruled that personal data indirectly revealing special categories of personal data defined in Article 9 (1) GDPR is also covered by the latter provision. 1183 In this ruling, the CJEU followed AG Pikamäe’s opinion by stating that ‘the verb “reveal” is consistent with taking into account processing of inherently 1179 Recital 7 GDPR. 1180 Cécile de Terwangne, Commentary of Article 5 in Christopher Kuner, Lee A. Bygrave, Christopher Docksey (eds), 1181 Asia Biega, Michèle Finck, ‘Reviving Purpose Limitation and Data Minimisation in Data-Driven Systems’ (2021) Technology and Regulation 44, 58 and 61 <https://arxiv.org/abs/2101.06203> accessed 8 February 2024. 1182 See Recitals 6 and 10 GDPR, as well as CJEU case law, such as Case C-534/20, Leistritz AG [2022] ECR I-594 para 26; Case C-645/19 [2021] Facebook Ireland ECR I-483 para 45; Case C-511/18, La Quadrature du Net [2020] ECR I-791 para 106; Case C-131/12, Google Spain [2014] ECR I-317 para 66. 1183 Case C-184/20, OT [2022] ECR I-601, paras 117-128. sensitive data, as well as data revealing information of that nature indirectly, following an intellectual operation involving deduction or cross-referencing’.1184 In the context of AI, this ruling is quite im- portant because ML might generate personal data that indirectly reveal special categories of personal data. ML models that apply dimensionality reduction (see Section 2.2.1.2) on easily accessible digital records of behaviour, for example, Facebook likes, may reveal and predict highly sensitive personal attributes such as sexual orientation, ethnicity, religious and political views and personality traits.1185 It is now clear that the processing of such data falls under the scope of Article 9 GDPR. However, the broad interpretation of special categories of personal data does not solve all the legal problems that might arise due to AI. This is mainly due to the principle1186 of enhancing protection for special data and the legislator’s approach to enumerate such data exhaustively. In Section 4.8.3, I outline that this approach has significant consequences considering the technological developments facilitated by AI. Both GDPR and its predecessor use the term ‘special categories’ of personal data, but also refer to ‘sensitive personal data’ in the recitals. 1187 In order to avoid confusion, I will use the term ‘special data’ to refer to data that are in fact, protected u...