Data Protection Online: Alternative Approaches to Sensitive Data?

The paper aims to review the criterion of “sensitive data” under Art. 8 of the Data Protection Directive 95/46/EC (DPD) in the online environment. Sensitive data is defined under Art. 8 as ‘personal data revealing racial origin, political opinions or religious or philosophical beliefs, trade union membership, and the processing of data concerning health or sex life.’ Following the Lindqvist case (C-101-01), it is questionable how the criterion applies in practice. More specifically, it can be contended that any images/photographs of the data subject uploaded on the internet falls within Art. 8 of the DPD because the image/picture reveals some of the characteristics that may be regarded as sensitive data. The paper also takes account of Professor Simitis’s report entitled Revisiting sensitive data published in 1999, which examined whether "sensitivity" really was a valid criterion for determining the conditions of the processing in the context of the Council of Europe Convention on Personal Data. In this review, the paper calls for a change in how sensitive data is assessed. It considers the purpose-based and contextualised approach to sensitive personal data in the online environment.