A human resources team is sorting the personal data it processes about employees into the correct GDPR regimes and must identify which items are special categories of personal data under Article 9(1), as distinct from data governed by other rules. Which two of the following items are special categories of personal data within the meaning of Article 9(1)? (Select TWO.)
- AA note recording that an employee follows a strict religious dietary requirement at catered company events. Correct
- BAn employee's bank account number and monthly salary figure held for payroll purposes.
- CA fingerprint template generated and stored specifically to verify an employee's identity at a building entrance. Correct
- DA record of an employee's spent and unspent criminal convictions gathered during a pre-employment safeguarding check.
- EAn employee's home postal address and personal mobile number recorded in the staff contact directory.
Why A is correct: A record revealing religious belief is a special category under Article 9(1), even when captured incidentally through a dietary note.
Why B is wrong: Financial details are ordinary personal data; Article 9 does not list financial status, so this is a tempting but incorrect choice.
Why C is correct: Biometric data processed for the purpose of uniquely identifying a person is a special category under Article 9(1).
Why D is wrong: Criminal conviction data is governed by Article 10, a separate regime, not by the Article 9(1) special category list, so it does not belong in the set.
Why E is wrong: Contact details are ordinary identifying data and are not among the categories Article 9(1) singles out as sensitive.