(1) Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be special categories of personal data.

(2) (Repealed: 2/3/2024- Art. 7499/33)

(3) (Amended: 2/3/2024- Art. 7499/33) It is prohibited to process special categories of personal data. However, such processing is permitted under the following conditions:

• a) Data subject has given his/her explicit consent,
• b) It is explicitly provided by laws,
• c) It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid,
• ç) It relates to personal data that have been made public by the data subject, and processing is in consistent with data subject’s intention to make such data public,
• d) It is necessary for the establishment, exercise or protection of any right,
• e) It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and for the planning, management and financing of health-care services by persons subject to legal obligation of confidentiality or by competent public institutions and organizations,
• f) It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance,
• g) It relates to the current or former members and affiliates of foundations, associations, and other non-profit organizations established for political, philosophical, religious, or trade union purposes, or to individuals who are in regular contact with these organizations, provided that such processing complies with the applicable legislation governing these organizations and their objectives, is limited to the organizations’ fields of activity, and does not involve disclosure of data to third parties.

(4) Adequate measures, as determined by the Board, shall also be implemented in the processing of special categories of personal data.