EDPB guidance on sensitive data and “legitimate interest” processing needs more clarity

UPDATE 16/10/24: Expanded analysis and added new section 4 on the use of personal data “scraped” from the Internet, to “train” AI models.

On 8 October, the European Data Protection Board (EDPB) issued guidelines on the processing of personal data on the basis of Article 6(1)(f) of the EU General Data Protection Regulation (GDPR). This Note is an immediate response to the EDPB comments in that document relating to the processing of certain special categories of personal data that enjoy special protection under the GDPR, commonly referred to as “sensitive data”. Specifically, the EDPB appears to suggest that such data can be processed on the basis of the “legitimate interest” legal basis set out in Article 6(1)(f) of the GDPR, provided certain “additional conditions” for processing of sensitive data contained in Article 9(2) GDPR are met. In this Note, I explain why this is not clear enough.