GDPR special category data: what Irish firms keep out of AI

Article 9 of the GDPR singles out personal data that can hurt people badly in the wrong hands: health, religion, ethnic origin, sexuality, union membership and a few more. In Ireland, the Data Protection Act 2018 then decides, section by section, who may still use it and on what terms.

This is for people who hold that data without thinking of it as sensitive: payroll bureaus, HR advisers, employment and family solicitors. Clinical letters have their own page on patient data and AI in an Irish practice. Here the question is what can go into an AI tool, and in what shape.

Is religion, age or date of birth special category data? Article 9 item by item

Religion is on the list, and so is anything that reveals it. That second part is where people go wrong. Article 9(1) prohibits processing personal data revealing a belief, an ethnic origin, a political view or union membership, so a document doesn’t have to name the category for the category to be in it.

The Court of Justice said so on 1 August 2022, in Case C-184/20: publishing data liable to disclose someone’s sexual orientation indirectly, such as a partner’s name, is processing special category data. No word search catches that, so deciding what personal data to redact needs someone who reads the whole file.

Ireland’s nine equality grounds against the special categories

Irish employers know a different list by heart. The Employment Equality Acts protect nine grounds: gender, civil status, family status, sexual orientation, religion, age, disability, race, and membership of the Traveller community. It overlaps with Article 9 only in part, and that partial overlap explains most of the confusion over age.

A WRC equality complaint is, almost by design, a file of Article 9 data, because the ground is the case. Some grounds that aren’t on the GDPR list can still give away one that is: a civil partnership can reveal orientation, and a parent’s status as carer can reveal a child’s disability.

If equality files crossed my desk, all nine grounds would get Article 9 handling before going near a model; the boundary is too easy to misjudge at five on a Friday. Witnesses named in the narrative get the same treatment, because your client can agree to an engagement letter AI clause and they never did.

Data Protection Act 2018 and special categories: sections 41 to 54

The GDPR lets each Member State fill in some of the Article 9(2) exceptions, and Ireland did it in Part 3 of the 2018 Act. Section 45 is the hinge: processing special categories is lawful where section 41 or sections 46 to 54 authorise it, or where Article 9 itself does, explicit consent included.

Most of those sections require suitable and specific measures, and section 36 lists them: access limits, erasure deadlines, training, logging, encryption and pseudonymisation, a term with its own trap explained in is pseudonymised data personal data. Section 47 skips that condition, which I wouldn’t read as a free pass.

Special category data examples in an Irish office file

Most of this data arrives inside documents built for something else. Section 5(9) of the Sick Leave Act 2022 asks only for a cert stating the employee is unable to work, yet many name the condition anyway. A scanned cert is a picture and needs a different redaction method before any tool reads it.

The DPC has looked at where that leads. In a 2022 case study, an employer could use an employee’s medical details to run sick leave and sick pay. Passing the specific nature of the illness to the local HR office was excessive, and the DPC found security and fairness failures on top.

For each file below, the last line is all I would let a model see. The people and figures are invented.

The clock export is the private version of a public case. On 12 June 2025 the DPC fined the Department of Social Protection €550,000 over facial matching at Public Services Card registration: no valid lawful basis under Articles 6(1) and 9(1). In 2021 the Department held templates for about 70% of the population.

Using AI with special category data: the step that needs its own reason

Ordinary personal data needs an Article 6 lawful basis. The Article 9 list needs that plus an exception, both tied to a purpose. Holding a cert lawfully doesn’t entitle you to send it to an outside provider; that step needs its own necessity. Which AI is GDPR compliant covers the provider’s half.

The Workplace Relations Commission was plain about it in version 2 of its AI guidance, 26 May 2026: be very careful with public tools, and don’t paste names, PPS numbers or medical information unless necessary and safe. If that is the advice to a lay complainant, a professional adviser can hardly argue for less.

Whatever sits in the middle is a processor too. A hosted gateway that handles your text on the way to the model needs its own contract, a point our explainer on AI gateways takes further.

The provider at the far end matters just as much. I’d want the business terms in writing before a single cert went through, starting with what ChatGPT keeps on each plan.

Firms on Microsoft 365 should read the enterprise terms instead, set out in what Copilot does with your data.

Before an HR or legal file goes into an AI tool

The fourth box is the one software can carry. Nonimo for Irish teams runs on Windows and Mac: highlight a passage, press the shortcut, and the details tying a sensitive fact to a person are swapped on your computer, shown to you before anything is sent. The reply comes back with your originals put back.

The diagnosis, the ground and the union line stay where you left them, because whether they belong in the prompt is a judgement only you can make. Your text never reaches us; the security page has the detail.

Whether section 46 or 47 actually covers a particular use is a question for your solicitor or data protection officer, on the facts of the file. What I’ve given you here is a general reading of the sections as enacted, not advice on yours.

Sources

• GDPR, Regulation (EU) 2016/679, text on EUR-Lex. Article 9 categories and exceptions, Article 10, Recital 51.
• CJEU, Case C-184/20, OT, 1 August 2022, judgment on EUR-Lex. Data indirectly revealing sexual orientation falls under Article 9(1).
• Data Protection Act 2018, section 45, Irish Statute Book. Special categories lawful where sections 41 and 46 to 54 or Article 9 allow; sections 36, 41 and 46 to 55 read on the same site.
• Sick Leave Act 2022, section 5, Irish Statute Book. The cert states only that the employee is unable to work.
• Data Protection Commission, case study on special category data (2022), dataprotection.ie. The nature of an illness sent to local HR found excessive.
• Data Protection Commission, Public Services Card decision, 12 June 2025, press release. €550,000 in fines; Articles 6(1) and 9(1); templates for about 70% of the population in 2021.
• Workplace Relations Commission, guidance on AI tools, version 2 of 26 May 2026, workplacerelations.ie. No names, PPS numbers or medical information unless necessary and safe.
• Citizens Information, equality in the workplace, citizensinformation.ie. The nine grounds of the Employment Equality Acts.
• Dáil Éireann, Traveller Ethnicity: Statements, 1 March 2017, Oireachtas debates. The Taoiseach formally recognised Travellers as a distinct ethnic group within the Irish nation.

Checked on 8 November 2026.