The position is that genetic data, as defined in Article 4(13) of the General Data Protection Regulation (GDPR), are personal data for the purposes of the GDPR and the Data Protection Act 2018. Moreover, under Article 9 of the GDPR and section 69 of the 2018 Act, genetic data are classified as a special category of personal data and the processing of such data is subject to enhanced protection standards.
Article 9(4) of the GDPR also provides that Member States may maintain or introduce further conditions, including limitations, with regard to the processing of inter alia genetic data. In this context, section 42(2) of the Disability Act 2005, as amended by the Data Protection Act 2018, prohibits the processing of genetic data in relation to the following:
- employment of a person,
- a policy of insurance or life assurance,
- a policy of health insurance or health-related insurance,
- an occupational pension, a retirement annuity contract or any other pension arrangement, or
- the mortgaging of property.