Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.
Source law
General Data Protection Regulation
Chapter II, Article 9, paragraph 4