After the recent Court of Justice of the European Union decision on sensitive inferences that can be drawn from the name of your spouse, it is fair to ask: Is everything sensitive data (special category data)?

Katie Hewson of Stephenson Harwood and I were duly skeptical earlier this month at the 7th annual INPLP Annual Conference in Vienna, Austria.

But…

• It IS a CJEU decision
• The definition of sensitive information under the new US privacy laws is Article 9 GDPR, plus more
• Sensitive inferences are a point of focus for the Federal Trade Commission and at issue in the new FTC Kochava case
• Sensitive inferences take on a new significance in the wake of the Dobbs decision
• Inferences are personal information and should be included in your response to CA access requests, along with, according to the California Attorney general, a detailed explanation of how the inferences were made (algorithmic transparency)
• Sensitive inferences are addressed in the draft Colorado CPA rules
• The NAI recently addressed them in a guidance regarding the advertising context.

And as a bonus:

• Sensitive inferences could be part of the new CPRA right to limit use of sensitive information, and in the Colorado CPA required opt in.