privacy gdpr medical
Is a Blood sample considered Personal Data under GDPR?
<p>Just that simple question:
Is a Blood sample considered Personal Data under GDPR?</p>

<p>If you mean the actual sample - no. It’s a physical thing, not data.</p>

<p>If you mean the results of testing then yes if they can identify an individual (like a DNA sequence) or are linked to an identifiable individual and no if they don’t (like they are part of an anonymised database of thousands of results).</p>

<p>From <a href="https://gdpr-info.eu/art-2-gdpr/" rel="nofollow noreferrer">GDPR Article 2</a>:</p>

<blockquote>
  <p>This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.</p>
</blockquote>

<p>A blood sample is not "personal data". If information is derived from the sample then that is personal data.</p>

<p>Also, if an organisation collects many blood samples then it must also be collecting associated data, such as when, where, who, why etc. These are certainly personal data, and their linkage with the blood sample makes them more personal because it is reasonable to suppose that future processing (such as analysis of the sample) will create <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/" rel="nofollow noreferrer">Special Category</a> data.</p>

<p>The GDPR defines bio-metric data as:</p>

<blockquote>
  <p>“personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person”.</p>
</blockquote>

<p>So yes a blood sample would fit. To analyze the data you would most likely be extracting data from it and analyzing it so that would mean you are a processor under the GDPR.</p>
