Recital 32a

The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.

To ensure legal certainty and support innovation, the processing of health data by a processor for the purposes of improving, maintaining, testing, ensuring the security of, or enhancing the performance of systems, models or services provided to a controller should not, in itself, result in that processor being considered a controller or joint controller, where such processing is carried out on behalf of the controller, within the purposes and scope determined by the controller, and subject to appropriate safeguards.

Processing of personal data strictly necessary for professional communications between legal persons and their representatives shall be assessed taking into account the legitimate expectations of the parties and the specific characteristics of business-to-business relationships.

The training of AI systems and AI models can constitute a legitimate interest of the controller within the meaning of Article 6(1), point (e), where such training is necessary for the development of AI systems and AI models.