The paper aims to review the criterion of “sensitive data” under Art. 8 of the Data Protection Directive 95/46/EC
(DPD) in the online environment. Sensitive data is defined under Art. 8 as ‘personal data revealing racial origin,
political opinions or religious or philosophical beliefs, trade union membership, and the processing of data
concerning health or sex life.’ Following the Lindqvist case (C-101-01), it is questionable how the criterion
applies in practice. More specifically, it can be contended that any images/photographs of the data subject
uploaded on the internet falls within Art. 8 of the DPD because the image/picture reveals some of the
characteristics that may be regarded as sensitive data. The paper also takes account of Professor Simitis’s report
entitled Revisiting sensitive data published in 1999, which examined whether "sensitivity" really was a valid
criterion for determining the conditions of the processing in the context of the Council of Europe Convention on
Personal Data. In this review, the paper calls for a change in how sensitive data is assessed. It considers the
purpose-based and contextualised approach to sensitive personal data in the online environment.