Personal Data, Special Category Data and Lawful Basis

Under data protection law (UK GDPR, EU GDPR, CCPA and others), personal data is any information that identifies or can identify a specific person. Special category data is a more restricted type of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, health data or data concerning sex life or sexual orientation. You cannot train models on personal data or special category data without a clear lawful basis for processing it. For example, a healthcare organisation using patient records to build a predictive model for disease outcomes must ensure that the data is processed lawfully. A financial services company using customer transaction data to predict credit risk must also ensure that the data is processed under a lawful basis. In both cases, the data must be processed in a way that complies with data protection principles and the specific requirements of the legislation.

Lawful bases under UK GDPR include explicit consent, contract necessity, legal obligation, vital interests of the person, public task and legitimate interests of your organisation. For model training, consent is the clearest basis. You obtained data from customers and explicitly asked their permission to use it for developing and training models. That is lawful. If you are using data collected for another purpose (for example, data collected at account opening for customer service), you need to carefully evaluate whether that original purpose is compatible with model training. Usually it is not, and you may need fresh consent. For instance, a retail company that collects customer data for order processing cannot automatically use that same data to train a model for targeted advertising without obtaining fresh consent. This is because the original purpose of collecting the data was not to enable automated decision-making or profiling. A practical step here is to implement a data audit process that tracks the original purpose of data collection and flags any potential secondary uses. This helps ensure that all data processing activities are compliant and transparent.

Legitimate interests is a weaker basis and increasingly difficult to rely on after regulatory scrutiny. The EDPB (European Data Protection Board) has issued guidance that legitimate interests is rarely justified for automated decision-making, especially for high-risk decisions like credit or employment where people face real consequences. Courts have been sceptical of legitimate interests arguments in these contexts. An example of this is a recruitment firm using an automated system to screen CVs. If the system is based on legitimate interests alone, it may not meet the legal standard. A more dependable approach would be to demonstrate that the use of the model is necessary for the performance of a contract (such as a job offer) or that it is required by law. A practical step is to conduct a Data Protection Impact Assessment (DPIA) before deploying any model that relies on legitimate interests. This helps to ensure that the processing is proportionate and that privacy risks are mitigated.

Special category data requires even stronger justification. You almost never have the right to train a model on data that reveals someone’s race, health status or trade union membership unless you have explicit, informed consent. Even with consent, some models should not be trained on special category data at all, regardless of consent, because using such data would violate anti-discrimination law. A credit model that relies on ethnicity as a predictor is discriminatory even if you have permission to use that data. A real-world example is a lending institution that collects data on applicants’ medical conditions to predict repayment capacity. Although this data may be collected under a legitimate interest or consent basis, using it to make lending decisions would be unlawful under the Equality Act 2010 and the UK GDPR. A practical step is to implement a special category data handling policy that outlines when and how such data can be used. This policy should also include a process for reviewing whether the use of special category data is necessary and proportionate.

You must document your lawful basis for using each dataset. If you used data collected for another purpose, you must document why you believe model training is compatible with that original purpose. If you relied on consent, you must show that consent was explicit, informed and freely given. If you used special category data, you must have documented justification and you should carefully consider whether the model even should be trained on that data. For example, a company that collects employee performance reviews for internal HR purposes must not use that data to train a model for workforce analytics without reassessing the lawful basis. A practical step is to create a data processing register that includes all datasets, their lawful basis and any associated risks. This register should be regularly updated and reviewed to ensure compliance. Additionally, it is important to train data controllers and data processors on how to properly document and justify their data processing activities. This helps to reduce the risk of non-compliance and ensures that all team members understand their responsibilities under data protection law.