Article 9 GDPR
Processing of specific categories of personal data

1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning that person's health, sexuality or sexual orientation is prohibited.

2. Paragraph 1 does not apply if one of the following conditions is met:

(a) the data subject has expressly consented to the processing of such personal data for one or more specific purposes, unless Union or Member State law provides that the data subject cannot lift the prohibition referred to in paragraph 1;

(b) the processing is necessary for the fulfilment of obligations and the exercise of specific rights by the controller or data subject in the field of labour law, social security and social protection, where permitted by Union or Member State law, or by a collective agreement under the law of a Member State providing for adequate safeguards of the fundamental rights and interests of the data subject;

(c) the processing is necessary to protect the vital interests of the data subject or of another natural person and the data subject is physically or legally incapable of giving consent;

(d) the processing is carried out within the framework of a legitimate activity carried out under appropriate safeguards by a foundation, association or other non-profit making body for political, public, religious or trade union purposes, provided that the processing concerns only members or former members of that body or persons who maintain permanent contact with it in connection with its purposes and that personal data are not disclosed to that body without the consent of the data subjects;

(e) the processing relates to personal data which have been made publicly known by the data subject;

(f) the processing is necessary for the establishment, investigation or defence of claims or for the administration of justice by the courts;

(g) the processing is necessary for reasons relating to a significant public interest, under Union or Member State law, which are proportionate to the designated purpose, do not infringe the essence of the right to data protection and provide for appropriate and specific measures to protect the fundamental rights and interests of the data subject;

(h) the processing is necessary for the purposes of occupational health or medical prevention, the assessment of the worker's ability to work, the medical diagnosis, the provision of healthcare or social security, the treatment or management of healthcare and social security systems and services under Union or Member State law or under a contract with a healthcare worker and subject to the conditions and safeguards referred to in paragraph 3;

(i) the processing is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border health risks or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices, under Union or Member State law which provides for appropriate, specific safeguards for the rights and freedoms of data subjects, in particular professional secrecy;

(j) the processing is necessary for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) under Union or Member State law which are proportionate to the intended purpose, do not infringe the substance of the right to data protection and provide for appropriate, specific measures to protect the fundamental rights and interests of the data subject.

3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in paragraph 2(h) if processed by - or under the responsibility of - an employee subject to the obligation of professional secrecy under Union law or the law of a Member State, or rules established by competent national authorities, or by another person also subject to the obligation of professional secrecy under Union law or the law of a Member State, or rules established by competent national authorities

4. Member states may retain or impose further conditions, including restrictions on the processing of genetic data, biometric data or health data.