Within the category of personal data, there is a subset known as special categories of personal dataPersonal data includes: 'any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person(…)” (EU GDPR Article 4 No. 1, 2016; BDSG §46 para. 1, 2018; BlnDSG §31, 2020). Read More. Their definition originates from Article 9(1) of the EU GDPR (2016), which states that these include information about the data subject’s:

• ethnic origin (e.g., skin color),
• political opinions (e.g., membership in a political party),
• religious or philosophical beliefs (e.g., affiliation with a religious community),
• trade union membership,
• health (e.g., illnesses),
• sex life and orientation (e.g., attendance at relevant venues).

This category also includes genetic and biometric data (e.g., fingerprints) used to identify a natural person. Under the General Data Protection Regulation (GDPR), these types of information are considered „sensitive“ because their collection, processing, or use may pose significant risks to the data subjects. Therefore, they are subject to special requirements and processing conditions. As a general rule, consentInformed consent refers to the agreement of research participants to take part in a study based on the basis of comprehensive and understandable information. The design of an informed consent must address both ethical principles and data protection requirements. Read More from the data subject must be obtained for the processing of personal dataThe term 'processing' is defined as 'any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;' (BlnDSG §31, 2020; EU GDPR Article 4 No. 2, 2016). Processing therefore refers to any form of working with personal data, from collection to erasure. Read More. Exceptions apply if the data have been made public by the data subject or if there is significant public interest (EU GDPR Article 9(2), 2016).

Ethnographic research projects often involve the collection of personal data, which is considered sensitive under the GDPR.