Political Opinions

Legal Framework

Article 9(1) GDPR establishes the core prohibition on processing personal data revealing political opinions, placing this category alongside racial or ethnic origin, religious beliefs, trade union membership, and other sensitive data types. Processing is prohibited by default, with Article 9(2) providing an exhaustive list of exceptions that controllers must satisfy cumulatively with a valid Article 6(1) legal basis.

"Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."
— GDPR Art. 9(1)

The available exceptions include explicit consent under Article 9(2)(a), vital interests under 9(2)(c), not-for-profit bodies with political aims under 9(2)(d), and data manifestly made public by the data subject under 9(2)(e). The Dutch implementation in Article 22 UAVG reproduces the same prohibition and exception structure.

"the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject"
— GDPR Art. 9(2)(a)

Key Developments

The CJEU addressed inferred political opinions in UI v Österreichische Post AG, where Austria's postal service used statistical extrapolation to assign individuals a political party affinity score without consent.

"In the course of its activity, Österreichische Post processed data which, by way of statistical extrapolation, led it to infer that the applicant in the main proceedings had a high degree of affinity with a certain Austrian political party."
— UI v Österreichische Post AG ¶12

The data was not shared externally, yet the Court acknowledged the processing caused adverse emotional effects. The ruling confirms that inferring political opinions through analytics triggers Article 9 regardless of whether results are disclosed.

The Dutch DPA has enforced this principle against multiple municipalities using "force field analysis" to map social structures.

"This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data."
— Municipality of Delft §2

The AP fined Delft €25,000, with identical findings against Ede and Eindhoven. These decisions establish that any analytical method surfacing political beliefs requires both an Article 6(1) basis and an Article 9(2) exception.

Status of the Debate

The prohibition itself is settled, but its boundaries are contested in court. Courts diverge on whether probabilistic political profiling—statistical inference of party affinity rather than direct collection of stated opinions—falls squarely within "revealing political opinions" under Article 9(1). UI v Österreichische Post addressed compensation thresholds rather than the substantive scope, leaving the boundary between inferred and revealed political data partially unresolved. No explicit court split is on record yet, but the question of whether indirect inference constitutes "revealing" political opinions under Article 9(1) remains an area where further CJEU guidance is needed.

Practical Guidance

• Verify both layers: confirm a valid Article 6(1) legal basis AND an Article 9(2) exception before processing any data that reveals or infers political opinions—the EDPB confirms both operate cumulatively.

• Treat inferred opinions as in-scope: statistical models and profiling that assign political affinity trigger Article 9, even when results remain internal—the Österreichische Post ruling confirms this principle.

• Explicit consent must be genuine: under Article 9(2)(a), consent must be freely given and specific; verify whether Member State law restricts or overrides this exception for political data.

• Avoid social mapping without a basis: force field analysis or stakeholder mapping that surfaces political beliefs requires an established Article 9(2) exception—the Dutch DPA has fined three municipalities for exactly this practice.

• Not-for-profit exception is narrow: Article 9(2)(d) applies only to political organizations processing data about their own members or former members, with appropriate safeguards—commercial entities cannot rely on this ground.