Part 2: General processing Chapter 2: The GDPR Section 10: Special categories of personal data and criminal convictions etc data
Article 9(1) of the GDPR generally prohibits the processing of "special categories of data". "Special categories of data" are defined in Article 9(1) of the GDPR as "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
	Article 9(2) of the GDPR provides for circumstances in which the prohibition on processing special categories of data in Article 9(1) may not apply. Some of these have direct effect and others take the form of derogations requiring Union or Member State law in order to be relied upon, subject to safeguards. Subsections (1) to (3) makes provision for processing of special categories of data in reliance on derogations contained in Article 9(2)(b), (g), (h), (i) and (j).
	Article 10 of the GDPR allows for processing of personal data relating to criminal convictions or related security measures to be carried out under the control of official authority or when the processing is authorized by Union or Member State law providing for appropriate safeguards for the rights and freedoms of others. Subsections (4) and (5) permit the processing of this kind of personal data otherwise than under the control of official authority.
	Subsection (1) introduces subsections (2) and (3), which make provision for the processing of special categories of personal data for reasons of employment, social security and protection (Article 9(2)(b)); substantial public interest (Article (2)(g)); health and social care (Article 9(2)(h)), public health (Article 9(2)(i)) and archiving, research and statistics (Article 9(2)(j)).
	Subsection (2) provides that processing under Articles 9(2)(b), (h), (i) or (j) is only permitted by UK law if it meets a condition in Part 1 of Schedule 1.
	Subsection (3) provides that processing under Article 9(2)(g) is only permitted by UK law if it meets a condition in Part 2 of Schedule 1.
	Subsections (4) and (5) provide that processing of personal data relating to criminal convictions and offences or related security measures is only permitted by UK law if it meets a condition in Parts 1, 2 or 3 of Schedule 1.
	Subsections (6) and (7) provide the Secretary of State with regulation-making powers to amend Schedule 1 by adding or varying processing conditions or safeguards, and omitting conditions or safeguards added by regulations, as well as powers to make consequential amendments to this section. These regulations are subject to the affirmative resolution procedure.
	This section does not reproduce all of the conditions previously found in Schedule 3 to the 1998 Act because many of these are now found in similar form in the GDPR and have direct effect, as demonstrated in the table below:
GDPR Article
Processing condition for special category of data
Equivalent provision in the 1998 Act
Article 9(2)(a)
The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where prohibited by law.
Paragraph 1 of Schedule 3
Article 9(2)(c)
Processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent.
Paragraph 3 of Schedule 3
Article 9(2)(d)
Processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects.
Paragraph 4 of Schedule 3
Article 9(2)(e)
Processing relates to personal data which are manifestly made public by the data subject.
Paragraph 5 of Schedule 3
Article 9(2)(f)
Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
Paragraph 6 of Schedule 3