Certified Information Privacy Professional – Europe (CIPP/E) — Question 277

Start-up company MagicAI is developing an AI system that will be part of a medical device that detects skin cancer. To take measures against potential bias in its AI system, the IT Team decides to collect data about users' ethnic origin, nationality and gender.

Which would be the most appropriate legal basis for this processing under the GDPR, Article 9 (Processing of special categories of personal data)?

Answer options

• A. Processing necessary for scientific or statistical purposes.
• B. Processing necessary for reasons of substantial public interest
• C. Processing necessary for purposes of preventive or occupational medicine
• D. Processing necessary for the defense of legal claims in potential negligence cases

Correct answer: C

Explanation

The correct answer is C because processing personal data for preventive or occupational medicine is explicitly permitted under GDPR Article 9, which is relevant for health-related data. The other options do not align as closely with the specific context of health and preventive medicine, making them less appropriate for this scenario.