(51) 依其本質對基本權及自由特別敏感之個人資料，因其處理過程 中可能對於基本權及自由造成顯著風險，故值得受到特別保護。該等 個人資料應包括顯示出種族或人種之個人資料，但本規則使用「種族」 乙詞並不代表歐盟承認旨於區別個別種族存在之理論。照片之處理不 應被制式化地認為係特殊類型之個人資料處理，蓋僅有在透過特殊識 別方法之處理而得獨特識別或驗證出當事人時，始得將照片涵蓋於生 物特徵識別資料的定義之下。該等個人資料不得處理，但其處理係本 規則明定之特別情況所允許，且考量到會員國法為使其與本規則規定 之適用相符以遵守其法定義務或符合公共利益執行職務或委託控管 者行使公權力而對於資料保護定有具體規範者，不在此限。除就該等 處理所定之特別要件以外，本規則所定之一般原則及其他規定亦應予 適用，尤其是涉及處理之合法性要件。為特殊類型之個人資料處理所 設一般禁止規定之例外，應予明確規定，包括：資料主體明確同意或 涉及特殊需求之資料處理，尤其是基於實現基本自由之目的而為某些組織或基金會之正當活動所為之處理者。
(51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms.
Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races.
The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.
Such personal data should not be processed, unless processing is allowed in specific cases set out in this Regulation, taking into account that Member States law may lay down specific provisions on data protection in order to adapt the application of the rules of this Regulation for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing.
Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.