Which exception to the prohibition on processing special categories of data must be explicit?

The requirement for explicitness in consent stems from the sensitivity surrounding special categories of data, which include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying an individual, data concerning health, or data concerning a person's sex life or sexual orientation. Given the heightened risks associated with processing such data, the General Data Protection Regulation (GDPR) mandates that consent must not only be informed and freely given but also explicitly stated to ensure that individuals clearly understand what they are consenting to.

This explicit consent must be distinguishable from other consents, and individuals should have a clear affirmative action, such as ticking a box, to indicate their agreement. This requirement is designed to protect individuals’ privacy and give them control over their sensitive information, adding a layer of security against potential misuse.

In contrast, the other options do not require the same level of explicitness. Vital interests, for instance, may not necessarily involve consent but rather focus on the needs of an individual whose life is at risk. Publicly available data can be processed without consent if it has been made available by the data subject themselves. Legitimate interests offer a broader basis for processing without explicit consent,