Special Categories of Personal Data

Under Article 9 of the GDPR, special categories of personal data are information whose misuse can have particularly serious consequences: health data, data concerning sex life or sexual orientation, biometric data for uniquely identifying a person, as well as information about origin, religion, political opinions or trade union membership. Processing this data is generally prohibited and only permitted in exceptional cases.

Why the industry is particularly affected

Working in front of the camera generates several types of this data at once:

• Health: STI test results, the test certificate, information about vaccinations or allergies
• Sex life: the yes-no-maybe list, agreed filming content, preferences in a set card
• Biometrics: facial matching and selfie videos during automated age checks

If such data becomes known, discrimination, blackmail or outing may result, both in private life and in a person’s main profession. This is why significantly stricter rules apply to it than to names, addresses or bank details.

When processing is permitted

The most important exception is explicit consent. It must be given voluntarily, for a clear purpose and separately, not hidden in general terms and conditions. It can be withdrawn at any time. In addition, the GDPR permits processing, for example, to fulfill legal obligations or when the person has clearly made the data public themselves. For agencies and productions, consent is the rule in practice.

What companies must consider

• Data minimization: collect only as much as necessary, such as viewing the test result instead of copying the laboratory report
• Access: only people who genuinely need the data
• Notifications: no sensitive content in emails, push notifications or messenger previews
• Deletion: set deadlines after which the data disappears
• Impact assessment: a written assessment of the risks in the case of extensive processing

At this agency, agreed filming content is visible only to the parties involved and the administration, and is not mentioned in notifications.

Sensitive information in set cards and profiles

Even voluntary information in a set card can be sensitive, such as sexual orientation, preferred filming content or health restrictions. For each field, consider whether the information is really necessary for productions and who can see it. Public profiles should show only what you consciously want to share. Internal information used solely for placements belongs in protected areas that guests and search engines cannot access. If you change or delete information, you should check whether it has also disappeared from exports and notifications.

Protecting your own data

• Show test certificates in person instead of sending them via messenger whenever possible.
• Read what you are consenting to, and withdraw your consent when the purpose no longer applies.
• Ask who can see boundaries lists and test results and when they will be deleted.
• Use your right of access to check what is stored.

How this agency protects sensitive information is set out in the Privacy Policy.