Compliance

special categories of data

Sensitive personal data requiring higher safeguards.

How the laws define this

Both instruments treat special categories of data as particularly sensitive personal data—specifically highlighting health, biometric, and criminal conviction data—that demand higher or stricter safeguards than ordinary personal information. However, the scope of listed examples and regulatory mechanics differs between the frameworks. Law No. 2018-493 of 20 June 2018 - Law on the Protection of Personal Data (adaptation of the French Data Protection Act to the GDPR) explicitly includes genetic and trade-union membership data, conditioning processing on stricter legal bases, national rules aligned with the GDPR, and transposed criminal-justice provisions. Conversely, Organic Act No. 2004-63 on the Protection of Personal Data does not mention genetic or trade-union data, focusing instead on administrative controls by subjecting sensitive data processing to specific formalities and, in certain instances, prior authorization under the Act. Consequently, compliance obligations vary from adhering to aligned legal bases and criminal-justice rules to fulfilling regulatory formalities and securing prior approval.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

Definitions (2)

Types of personal data that are particularly sensitive—such as health, genetic, biometric, trade-union membership or criminal conviction data—subject to stricter legal bases and higher safeguards under national rules aligned with the GDPR and transposed provisions for criminal-justice processing.

Categories of personal data considered sensitive—such as health data, biometric data and data concerning criminal convictions—which are subject to stricter safeguards, specific formalities and, in some cases, prior authorization under the Act.