Part 5: Data Protection and Privacy Processing of special categories of personal data Section 74: Processing of special categories of personal data
Article 9(1) of the UK GDPR sets out an exhaustive list of special categories of personal data, sometimes known as "sensitive data". Processing of data in this list is prohibited unless a condition in Article 9(2) is met, together with any associated DPA 2018 Schedule 1 conditions where required. Processing of data in this list is also subject to various obligations or considerations imposed by other provisions in the data protection framework, for example the requirement in Article 37 to designate a data protection officer if certain conditions are met.
	This section confers regulation-making powers to the Secretary of State to add new special categories of data, tailor the conditions applicable to their use, and add new definitions, if necessary, to enable the Government to rapidly respond to future technological and societal developments.
	This section provides four regulation-making powers to update the protections in Article 9 and reciprocal provisions in Part 3 and Part 4 of the DPA 2018.
	Section 74(1) creates a new Article 11A (1) to confer regulation-making powers to the Secretary of State. The powers enable the Secretary of State, by regulations, to:
Add new special categories of data to the general prohibition in Article 9(1) UK GDPR. Categories in Article 9(1) may not be processed unless the controller meets a condition in Article 9(2), as supplemented by Schedule 1. This power is set out in new Article 11A(1)(a);
Remove any categories of special category data that have been added by such regulations. This power cannot be used to remove any of the pre-existing categories in Article 9(1). This power is set out in new Article 11A(1)(b);
Make provision that any of the existing conditions in Article 9(2) may or may not be relied on in relation to any new category added by regulations. This is because the conditions under Article 9(2) were drafted with only the current special categories in Article 9(1) in mind. If a new special category is recognised in the future, it may be necessary to alter which of the existing conditions apply to it in order to provide more specific protection. This power is set out in new Article 11A(1)(c); and
Make provision to vary any of the existing conditions in Article 9(2), but only as it relates to any new categories added by regulations. This power cannot be used to remove or vary conditions for existing special categories under Article 9(2). This power is set out in new Article 11A(1)(d).
	New Article 11A (2) clarifies that the regulation-making powers to remove prohibitions from Article 9(1) and to vary the applicability of conditions under Article 9(2) only apply to new descriptions of special categories added under regulations. The powers cannot be used to remove existing special categories from Article 9(1) or to remove or vary conditions for existing special categories under Article 9(2).
	New Article 11A (3) supplements these provisions, enabling textual amendments to be made to sections 5, 205, and 206 of the DPA 2018, by making a consequential amendment relying on Article 91A(4b). These provisions contain definitions that may need amending if new descriptions of processing are added in the future to the list of special categories of data in Article 9(1).
	New Article 11A (4) provides that the regulations made under these powers are subject to the affirmative resolution procedure.
	New Sections 42A and 91A deal with equivalent powers under Part 3 and Part 4 DPA 2018 respectively. Section 35(6) of Part 3 DPA 2018 sets out a list of "sensitive processing", where the processing described is only lawful where a condition in Schedule 8 DPA 2018 can be met, if the data subject has not consented to the processing. Section 86(7) DPA 2018 sets out an equivalent list for Part 4. All processing under Part 4 requires a condition under Schedule 9 to be met, and for sensitive processing a condition under Schedule 10 must also be met.
	New Section 42A provides powers for the Secretary of State to, by regulations:
Add additional categories of sensitive processing to those provided in section 35(6);
Remove categories of sensitive processing which have been added under that power;
Make provision that any of the existing conditions required for sensitive processing under Schedule 8 may or may not be relied upon for added categories of sensitive processing; and
Make provision to vary conditions under Schedule 8 for categories of sensitive processing added under this power.
	New section 42A (2) clarifies that the regulation-making powers to remove categories of sensitive processing under section 35(6) and vary conditions under Schedule 8 can only be exercised in relation to new categories added by regulations. These powers cannot remove existing categories of sensitive processing under section 35(6) or vary conditions in Schedule 8 in relation to those existing categories.
	New section 91A provides the same powers for the sensitive processing regime under Part 4 of the DPA 2018. New section 91A provides power to the Secretary of State to, by regulations:
Add additional categories of sensitive processing to those already provided in section 86(7);
Remove categories of sensitive processing that have been added under that power;
Make provision that any of the existing conditions required for sensitive processing under Schedule 10 may or may not be relied upon for added categories of sensitive processing; and
Make provision to vary conditions under Schedule 10 for categories of sensitive processing added under this power.
	New section 91A (2) clarifies that the regulation making powers to remove categories of sensitive processing under section 86(7) and vary conditions under Schedule 10 can only be exercised in relation to new categories added by regulations. The powers cannot remove existing categories of sensitive processing under section 86(7) or vary conditions in Schedule 10 in relation to those existing categories.
	New section 42A(3) and 91A(3) enable amendments to be made to sections 205 and 206 DPA 2018. This will allow definitions to be amended if new categories of sensitive processing are added in the future to the categories already provided in sections 35(6) or 86(7).
	New sections 42A(4) and 91A(4) provide that regulations made under these powers are subject to the affirmative procedure.
	Subsections (4) and (7) of this section amend sections 35(6)(b) and 86(3)(b) DPA 2018 to allow the Secretary of State to vary the conditions required to be met for sensitive processing in Schedule 8 and Schedule 10 respectively, where those conditions have been added by regulations made under sections 35(6)(a) and 86(3)(a) respectively.
	The section also makes consequential amendments to section 202 Investigatory Powers Act 2016 (IPA 2016). Subsection (11) of the section aligns the language regarding sensitive personal data in section 202 IPA with Part 4 DPA 2018. This clarifies that the existing definition of "sensitive personal data" in section 202(4) IPA corresponds to the processing to be undertaken and the specified categories of "sensitive processing" in section 86(7) DPA 2018.
	Lastly, new section 202A IPA enables the Secretary of State to, by regulations, add categories of sensitive processing described in Part 4 DPA 2018 to section 202(4) IPA. This is to allow for changes made to the descriptions of sensitive processing contained in section 86(7) to be included in section 202(4) IPA 2016 where appropriate but does not confer powers to remove or amend existing categories referred to in section 202(4) IPA. Regulations under this power are subject to the affirmative procedure.