What is special category personal data? (GDPR Art. 9)

GDPR Art. 9 in principle prohibits the processing of special categories of personal data. This data is sensitive because it can lead to discrimination, stigmatisation, or safety risks. The 9 categories: (1) racial or ethnic origin, (2) political opinions, (3) religious or philosophical beliefs, (4) trade-union membership, (5) genetic data, (6) biometric data (fingerprint, face recognition, iris scan) when used to uniquely identify a person, (7) health data, (8) data on sexual behaviour or orientation, (9) criminal data (Art. 10 — strictly separate regime). Prohibition unless: processing only under one of 10 exceptions — explicit consent, employment-law obligation, vital interest, made public by data subject, legal proceedings, substantial public interest, preventive medicine, public health, archiving, or non-profit member-statute. What is NOT special? A passport photo is not a special category, but face recognition on that photo is. An opinion poll on political preference without names is not special. But linked to ID = yes. Fines: Art. 9 violations fall under the higher fine category (up to €20m / 4% turnover). Examples of violations: webshop inferring religion from first names, supermarket app recording diet (vegetarian → assumed religion), HR system tracking pregnancy, a physiotherapist sharing diagnosis with a partner without consent. UAVG specificity: Netherlands has additional exceptions in UAVG Art. 30-46 for healthcare, social security, and police. Criminal data (Art. 10): only under government supervision or by law — not for private parties except in very specific exceptions (Dutch VOG procedure, financial-sector fraud database under AP waiver).