Legal Basis for Considering Self-Exclusion as Special Category Data
Under Article 9(1) of the GDPR, data that reveals an individual’s health status or mental health condition is considered special category data. Self-exclusion from gambling is often linked to gambling addiction, which can be recognized as a mental health issue. While there is no explicit reference in GDPR or case law that directly states “self-exclusion data is special category data,” legal interpretations from regulatory bodies and case law precedents suggest that it falls into this category.
Article 9 GDPR. Processing of special categories of personal data
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
If self-exclusion data suggests gambling addiction, which is a potential mental health issue, it falls under GDPR Article 9 protections or not?
We consider this legal question was not yet solved when it comes to Romanian gambling legislation and not only.
Several scenarios may be taken into consideration:
i. Licensees should consider the requirements of their license As licensees must achieve these outcomes, licensees should:
1. consider what personal data should be processed to achieve these outcomes
2. consider which of the permitted lawful bases for processing may apply to such processing
ii. Licensees should formulate effective policies, procedures and controls in this areas
iii. Licensees should also consider to what extent data subject rights, such as the right to erasure and right not to be subject to automated decision-making, may not apply given the relevant lawful basis
iv. Licensees should consider what retention period is necessary for any data obtained and processed for self-exclusion or anti-money laundering purposes (whether also obtained for other purposes). Operators should take into account that in specific situation, the regulatory body may need to obtain such data even after an account has closed in order to establish whether or not a licensee has complied with its regulatory obligations.
Regulatory Guidance & Case Law Considerations
We need to highlight several court case, related to the interpretation of a special category of data
The CJEU ruled that even indirectly revealing special category data—such as inferring a person’s political opinion from their participation in events—could make it subject to Article 9 GDPR
136/17 – GC and Others v. CNIL (2019)
Recitals of 4, 51 and 52 of Regulation 2016/679 state:
(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, … the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, (…)
(51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. (…)
(52) Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and other fundamental rights (…)
This case further reinforced the broad interpretation of sensitive data, emphasizing that if data can infer protected characteristics, it must be safeguarded under GDPR
34/21 – OT v. Vyriausioji tarnybinės etikos komisija (2022)
The ICO (UK’s data protection authority) has indicated in its guidance on GDPR that self-exclusion records may be considered special category data because they imply a person is dealing with problem gambling, which can be linked to mental health.
The ICO’s opinion suggests that processing self-exclusion data must meet the higher standards of protection under Article 9 GDPR.
The UK Gambling Commission also supports this view, emphasizing that such data is highly sensitive and must be treated with additional safeguards.
Romanian Data Protection Authority Perspective (ANSPDCP)
The ANSPDCP has not issued a specific ruling on self-exclusion data, but it has taken a strict stance on processing sensitive data, particularly in cases where information can imply a person’s health status.
The ANSPDCP follows the broad interpretation of Article 9 GDPR, which aligns with the CJEU rulings that indirect indicators of special category data should be treated with heightened protection.
The authority has imposed fines on organizations that failed to secure sensitive personal data, even when it was not explicitly health-related but could indirectly reveal health or addiction issues.
As an example, in 2021, ANSPDCP fined a medical clinic for improperly handling patient data, citing GDPR’s Article 9 protections. This case reinforces that if data processing suggests a medical condition (like gambling addiction), it must be treated as special category data.
Conclusion
While no single court ruling explicitly states that self-exclusion data is always special category data, regulatory bodies and legal interpretations may suggest that it qualifies under Article 9 GDPR because it indirectly reveals gambling addiction or mental health concerns. The CJEU’s broad interpretation of what constitutes special category data further supports this view.
