What to do with derived sensitive personal data?

Can you make models that may derive sensitive personal data?

In principle, you can make anything, but as soon as you start processing personal data, you have to take the GDPR into account. When processing personal data, you need to use one of six processing grounds. If you want to process sensitive personal data, in addition to a valid processing ground, you need to be able to use one of the ten exceptions to the ban on processing sensitive personal data.

The question now, of course, is whether personal data predicted by a model should also be treated as personal data. If a predicted data point is connected to a set of personal data, then this also becomes personal data. Should the derived data point reveal information about any of the subjects that fall within sensitive personal data, then that data point is also sensitive personal data.

Thus, if a model can derive a characteristic of sensitive personal data, based on personal data, the requirements of processing sensitive personal data must be met as well.