Go back to the main page of the Data Protection Guidance for the organisers
Data Protection Guidance - Question 3
‘Sensitive data’ - when do the signatories’ data qualify as a special category of data?
Data relating to religion, political opinions, health, etc. is considered as a special category (‘sensitive data’) under GDPR and EUDPR and gets special protection. Sensitive personal data can only be processed by organisations if specific safeguards are in place.
Supporting a European citizens’ initiative is a political activity and may reveal signatories’ political opinions, religious or philosophical beliefs, orientations, etc.
Recital 12 of the Regulation on the European citizens' initiative explains that:
‘While personal data processed in application of this Regulation might include sensitive data, given the nature of the European citizens' initiative as an instrument of participatory democracy, it is justified to require the provision of personal data to support an initiative and to process such data as far as it is necessary in order to allow statements of support to be verified in accordance with national law and practice’.
Where signatories’ data qualify as a special category of data (‘sensitive data’), additional measures need to be taken to ensure the lawful processing of such data. Notably, it is mandatory to appoint a Data Protection Officer (DPO). Where such data are processed on a large scale it is also mandatory to carry out a data protection impact assessment (DPIA).
PLEASE NOTE:
If processing of signatories’ data is carried out under joint controllership with the Commission, all Commission services are adapted to the fact that the data concerned may be sensitive. In particular, all data are stored in an encrypted form and the processing is covered by a DPIA. The DPO of the Commission monitors the implementation by the Commission of its obligations under the EUDPR with regard to the processing operations for which the Commission is responsible.
References:
- Articles 5(1)(b) and 9 of the GDPR, Article 10 of the EUDPR
- Recital 12 of the Regulation on the European citizens' initiative
