Guidelines 08/2020 on the targeting of social media users – version for public consultation

Section 8.1  What constitutes a special category of data

106 The GDPR provides specific protection for personal data that are particularly sensitive in relation to individuals’ fundamental rights and freedoms. Such data are defined in Article 9 GDPR as special categories of personal data and include data about an individual’s health, racial or ethnic origin, biometry, religious or philosophical belief, political opinion, trade union membership, sex life or sexual orientation.

107 Controllers may only process special categories of data if they can meet one of the conditions set outin Article 9 (2) GDPR, such as having obtained the data subject’s explicit consent or the data have been manifestly made public by the data subject. In addition to the conditions in Article 9, processing of special categories of data must rely on a legal basis laid down in Article 6 and be carried out in accordance with the fundamental principles set out in Article 5.

108 Furthermore, the processing of special categories of personal data is relevant when assessing appropriate measures according to Articles 24, 25, 28 and 32 GDPR, but also to determine whether a DPIA must be carried out according to Article 35 GDPR, and whether a data protection officer must be appointed under Article 37GDPR.

109 In the context of social media and targeting, it is necessary to determine whether the processing of personal data involves “special categories of data” and if such data are processed by the social media provider, the targeter or both. If special categories of personal data are processed, it must be determined whether and under what conditions the social media provider and the targeter can lawfully process such data.

110 If the social media provider processes the special category of data for targeting purposes, it must find a legal basis for the processing in Article 6 GDPR and rely on an exemption in Article 9 (2) GDPR, such as explicit consent according to Article 9 (2) (a) GDPR. If a targeter engages a social media provider and requests that the social media provider targets users based on this special category of data, the targeter will be jointly responsible with the social media provider for the processing of the special category data.

111 The following legal analysis will explore different situations when such processing may take place and their legal implications.