Recital 51

(51) Personal data that, by their nature, are particularly sensitive in light of fundamental rights and freedoms, require special protection, as the context in which they are processed may cause serious risks to fundamental rights and freedoms. Such personal data should include personal data revealing racial or ethnic origin, although the use of the term "racial origin" in this Regulation does not imply that the Union accepts theories suggesting the existence of separate human races. The processing of photographs should not always constitute the processing of special categories of personal data, since photographs fall under the definition of "biometric data" only in cases where they are processed by special technical methods that allow the unambiguous identification of an individual or confirmation of his or her identity. Such personal data should not be processed unless this Regulation permits their processing in specific cases, taking into account that Member State law may include specific data protection provisions adapting the application of the provisions of this Regulation so that legal obligations can be fulfilled or a task carried out in the public interest or in the exercise of public authority entrusted to the controller can be carried out. In addition to the specific requirements applicable to such processing, the general principles and other provisions of this Regulation should apply, in particular as regards the conditions for lawfulness of processing. Exceptions to the general prohibition on the processing of such special categories of personal data should be expressly provided for, inter alia, in the event of the express consent of the data subject or for special needs, in particular when the processing is carried out in the framework of the legitimate activities of certain associations or foundations whose purpose is to enable the exercise of fundamental freedoms.

Receive a free package of 4 tutorials and 4 e-learning trainings
The controller of your data is ODO 24 sp. z o. o.
Recital 51 of the preamble to the GDPR | ODO 24