Regulation and data
Health data
Data concerning health are those revealing a person's physical or mental health status (art. 4.15 of the GDPR). They are a special category: art. 9 prohibits processing them unless one of the exceptions in its paragraph 2 applies. In a residence, the everyday case is the dining hall's allergies and intolerances.
Also known asdata concerning health · special category data · datos de salud
What counts as health data
Recital 35 reads them broadly: any information about a disease, a disability, the risk of having one, the medical history or a clinical treatment, whatever its source. A centre comes across more of them than it counts:
| What comes in | Health data? |
|---|---|
| A food allergy or intolerance | Yes; the kitchen needs it to check it against the allergens in each dish |
| "I have a temperature, can you bring my lunch up?" | Yes, even when it arrives in a WhatsApp message |
| A declared medication or disability | Yes |
| "I twisted my ankle on the stairs" | Yes, even when it comes in as a fault report about the stairs |
| A vegetarian diet by choice | No, unless there is a medical reason behind it |
| A diet for religious reasons | No, but it may reveal another special category: religious beliefs |
Worth knowing
An exception under art. 9.2 is needed, on top of a basis under art. 6. In a residence it is usually explicit consent (art. 9.2.a): see consent. Processing them with no exception at all is a very serious infringement (art. 72.1.e of Spain's LOPDGDD). Who should be able to see them and how long they are kept is in the guide to the GDPR in student residences.
Sources
Related terms
- AllergensAllergens are the substances that cause allergies or intolerances and that EU law requires to be declared: fourteen of them, from gluten to molluscs. A residence dining hall must be able to say which ones each dish contains, even when the food is served unpackaged.
- ConsentConsent is a voluntary, specific, informed and unambiguous indication of a person's wishes by which they agree, through a statement or a clear affirmative action, to the processing of their data (art. 4.11 of the GDPR). It is one of the six legal bases, and the only one the data subject can withdraw at any time.