Days ago a friend asked me for a confirmation that for the lawfulness of the processing of special categories of personal data – but the issue also concerns the “judicial” data of Article 10 – it was indeed necessary to identify also a specific legal basis, in addition to the proper regulation of these types of data: that is, to fulfill the requirements of Article 6, in addition to those indicated in Articles 9 and 10 of the Regulation.

I had been solicited since others, interviewed on this point, expressed an opposite view, arguing for the sufficiency of Articles 9 and 10 as a source (alternative to Article 6) for regulating the lawfulness of processing of, respectively, special categories of personal data and data relating to criminal convictions and offenses. 

Already in the time when Directive 95/46/EC was in force, the question of the relationship between the principles of legitimation of processing and the rules for the processing of special categories of personal data had been raised; that is, between what, according to the current GDPR, are the legal bases of Article 6 and the rules of Article 9, as an exception to the ban on the processing of so-called sensitive data.