Special Categories of personal data in customer records
The majority of data collected from customer records (address and contact details; attendance behaviour) arises from their transactions. It is important to note that GDPR defines certain sensitive "special categories" of personal data.
These categories of data require extra justification to be processed. In most cases, this will mean you need the explicit consent of the data subject to collect and process any data that falls into these categories.
This will be relevant if you add data collected by survey to customer records, or indeed create customer records directly from a survey (e.g. join our mailing list).
Sensitive data concerns an individual’s:
- racial or ethnic origin
- political opinions
- religious beliefs or other beliefs of a similar nature
- trade union membership
- physical or mental health or condition
- sexual life
- generic data
- biometric data
Personal data relating to criminal convictions and offences are no longer included as ''special categories'' of personal data under GDPR, but similar extra safeguards apply to its processing.
Some organisations offer online self-selecting choice of preferences, interests and socio-economic profiling information (age or decade of birth, age of children in the family, ethnic origin) and need to be specific about the purposes for which this data will be used and make clear what customers are consenting to. For example, “to ensure that we treat all our customers fairly”.
For more information on processing ''special categories'' of personal data, please see the relevant provisions in the GDPR - Articles 2, 4, 9, 10 and Recitals 1, 2, 26 and 51.