European Union: CJEU Preliminary Ruling in case C-184/20 on interpretation of special categories of personal data and sensitive data

On 1 August 2022, the Court of Justice of the European Union (CJEU) issued a preliminary ruling in case C-184/20 filed by the Regional Administrative Court of Vilnius regarding, in part, the issue of the interpretation of the special categories of personal data, the processing of which is prohibited under Article 9(1) of the General Data Protection Regulation (GDPR). The Administrative Court asked whether the GDPR precludes national law from requiring declarations of private interests to be made and published from which further information about an individual's political views, trade-union membership, sexual orientation and other personal information could be deduced. Specifically, the case concerned a Lithuanian provision requiring public service workers to make a declaration, to be published on a website, including information on their spouse, cohabitee or partner. The CJEU found that such information would permit the deduction of further sensitive information on an individual's sex life or sexual orientation. As a result, the publication of such information liable to indirectly reveal further sensitive information about an individual should also, by extension, be interpreted as constituting the processing of special categories of personal data, prohibited by the GDPR unless one of the specified exceptions applies. Following the CJEU ruling, any entity will have to obtain explicit consent if they will deduce sensitive information on its users.