Nordic Privacy Summit: balancing SCD definitions and workability

Hopefully thought-provoking? My keynote on “Personal Data in a Digital World: What Are We Protecting?” kicked off the Nordic Privacy & Innovation Summit 2025 today in Stockholm. Among my topics: SRB, OT, ePrivacy, AI and AI model training, plus how to make the GDPR more workable (see slides, which show that data protection involves a balance and that we have to be wary of absolutism).
 
A topic I haven’t yet written much about is that of special categories of data (SCDs).
 
The idea behind the EU Court of Justice’s OT judgment (1 Aug 2022) sounds logical: if a spouse’s name can reveal sexual preference, shouldn’t it be treated as an SCD under Art. 9(1) GDPR?
 
However, this approach is unworkable. Tampon purchases can reveal that a woman isn’t pregnant. Combine OT with the Lindenapotheke case (“over-the-counter drug sales reveal health data about the purchaser, even if the medication isn’t intended for him/her”), and a simple supermarket ticket suddenly involves the processing of SCDs (!). It doesn’t make sense for Art. 9 to apply though in such a case.
 
Based on the leaked Digital Omnibus draft, some at the Commission clearly understand that for the SCD provisions to be workable, *they must only apply to actual inferences* – not hypothetical or indirect ones. Hence information that “directly” reveals e.g. health status. Some have claimed this is a blank cheque for GDPR violations, but the truth is that without this, *everything* is potentially an SCD, because much could theoretically be inferred even if incorrect (“video surveillance = racial data”; “employee absence = health data”; “lunch choice = health data”; “opinion = political affiliation”; etc.).
 
Kudos to (some at) the EC. Let’s hope this idea survives lobbying attempts to consecrate absolutism!

Further reading:
– Mikołaj Barczentewicz’s piece on the Digital Omnibus: https://lnkd.in/eqeFvYH5
– Dr M.R. (Mark) Leiser’s in-depth analysis and rebuttal of the NOYB/EDRi/ICCL talking points on the Digital Omnibus: https://lnkd.in/enYaFc2u
– My summary of the draft: https://lnkd.in/ec7aBC2A