3.1 What is meant by sensitive data?
Some personal data are by nature more sensitive and therefore more in need of protection. The GDPR distinguishes between “non-sensitive” personal data and sensitive personal data. The basic rule is that it is forbidden to process sensitive personal data unless in exceptional cases (see 3.2). Sensitive personal data are those concerning:

race* or ethnic origin
political opinion, religious or philosophical beliefs
trade-union membership
genetic data
biometric data for the purpose of uniquely identifying a natural person
health (for ex. sick-leave, pregnancy, doctor’s appointments)
a natural person´s sex life or sexual orientation.
The word “race” is not used in Swedish law. It is used in the GDPR, however, with the caveat that its use does not imply acceptance of theories that attempt to determine the existence of separate human races.

3.2 How may sensitive personal data be processed?
The basic rule is that sensitive personal data may not be processed unless allowed by GDPR exemption (Art. 9.2). Here are some examples:

Generally it is prohibited to register information about union membership. If, however, the processing of such data is necessary for the fulfilment of an employer’s legal obligations and if appropriate measures are taken to safeguard the data, such processing is permissible. In this case, the employee must be informed that his/her data is being processed by the employer and for what purposes.

If information about dietary preferences is processed (e.g. in connection with a conference), any such information, concerning for example halal or kosher requirements, can constitute sensitive data if it is possible to connect the data subject to a religious belief. Such data may, however, be processed if consent is given.

Genetic data concern a person’s inherited or acquired genetic characteristics and provide unique information on a natural person’s physiology or health. Such data can be obtained from the analysis of biological samples.

Biometric data concern a person’s physical, physiological or behavioural characteristics. Such data can be obtained via certain technical procedures involving fingerprints, machine-readable images, etc. for the purposes of identification. Like genetic data, not all biometric data are sensitive.

If, as an employee of a public authority, you have to process sensitive personal data in the exercise of your duties, it may be permitted with the support of the law or the authority’s particular government or parliamentary assignment. If the processing of personal data is necessary for certain stated purposes, such as the provision of healthcare, sensitive personal data may be processed.