Is information about private relations sensitive personal data? Summary Our remarks Under the Lithuanian anti-fraud law, officials were • There is generally a prohibition against processing required to provide information about their spouse, special categories of personal data. Prior to cohabitant, or partner. such as full name, social security processing sensitive personal data, it is imperative number, place of employment, etc. An official contested to have a lawful basis in GDPR, Article 6(1), and to this requirement, arguing that the information he was meet one of the exemptions in GDPR, Article 9(2). required to give revealed sensitive personal details, as the sexuality of the official could be deduced from this • Personal data that is not sensitive in itself but information. can indirectly reveal information about sexual orientation is considered sensitive data. This can be The preliminary questions that were brought before The data like: Court of Justice of the European Union (CJEU) were the following: ° The full name of a partner that can reveal sexual orientation. 1. Is national legislation that requires online publication of name-specific data relating to an • It is a bit uncertain how this judgment should be official’s family members precluded by GDPR, applied in practice, but overall, it is advisable to Article 6(1) and (3)? initially to assess whether personal data being processed includes any information that reveals 2. Is personal data that can indirectly reveal sensitive personal data. The data controller needs the special categories of a natural person to evaluate if they process any regular types of considered special category data under the data that can reveal special types of information. GDPR? • The judgment could also be a prompt to rethink The decision of the European Court of Justice your erasure policy, as potentially more personal data can be considered to be sensitive personal The CJEU found that national legislation that requires data. online publication of name-specific data relating to an official’s family members or other close individuals is precluded by GDPR, Article 6(1)(c) and (e) and Article 6(3). The CJEU also ruled that the publication of personal data which indirectly discloses someone’s sexual orientation constitutes the processing of special categories of personal data under GDPR, Article 9(1). Published: 01-08-2022, Journal number: N/A Tags: 01 Basis and principles of processing 134