Article 70 Processing of certain categories of personal data

This article addresses the conditions under which competent authorities — including FIUs, supervisory authorities, and law enforcement bodies — may process sensitive personal data, specifically special categories of data (such as health or biometric data under GDPR) and data relating to criminal convictions and offences.

It sits alongside the broader data protection framework of the regulation and carves out a permissible basis for this processing, provided a set of specific internal safeguards are met.

The article extends these same requirements to Union institutions, bodies, offices, and agencies when they process equivalent categories of data for the purposes of this Directive.

Important points:

• Competent authorities are permitted to process special categories of personal data and criminal conviction data only to the extent necessary for the purposes of this Directive, and only with specific safeguards in place.
• Processing must be carried out on a case-by-case basis, exclusively by staff who have been specifically designated and authorised, and those staff must maintain high professional standards of confidentiality, integrity, and skill, including in handling big data sets.
• Technical and organisational measures ensuring data security to high technological standards are required, and these same safeguards apply equally to Union institutions, bodies, offices, and agencies.