In line with GDPR art. 9(1), it is prohibited to process data that reveal any of trade union membership, beliefs (religious or philosophical), political opinions, or racial or ethnic origin, and to process genetic data, biometric data for uniquely identifying a person, health data, or data concerning a person's sexual orientation or sex life (22(1)). Restating five of the GDPR's own grounds (art. 9(2) points a, c, d, e, f), the prohibition does not apply where: the data subject gave explicit consent for one or more specified purposes; processing is necessary to protect vital interests where the data subject cannot consent; a non-profit political, philosophical, religious or trade union body processes data of its members or regular contacts with safeguards and without disclosure outside it; the data subject has manifestly made the data public; or processing is necessary for legal claims or courts acting in their judicial capacity (22(2)). In an employment setting explicit consent is rarely freely given; the UAVG's own grounds follow in arts 23 to 30.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.