Special category data: the information with a force field

Art. 9 flips the logic: for this list, processing is forbidden unless a specific exception applies. The list: health data, sex life and orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, and biometric data used to identify you. The exceptions that matter in real life: your explicit consent (a higher bar than normal consent); medical care by professionals under secrecy; employment and social-security law where statute commands; data you manifestly made public yourself; and legal claims. “Legitimate interest” is not on the list — no company profiles your health because it finds that interesting. The inference trap: the CJEU has held that data revealing sensitive traits counts — a supermarket deriving pregnancy from purchases, an ad system inferring orientation from behaviour, sit inside Art. 9 whether or not you ever “told” anyone. That is the legal wall loyalty profiling and face scanning keep hitting. When it leaks or gets misused, everything escalates: breach risk assessments weigh heavier, DPA priority is higher, and damages for exposed medical or intimate data sit at the top of the range.