1. Introduction
In recent decisions, the Court of Justice of the European Union (CJEU) has clarified its interpretation of what constitutes “sensitive” (or special category) data under the GDPR. These rulings provide valuable guidance as even seemingly standard data processing may involve sensitive data – and thus be prohibited – under Art. 9(1) of the