Just that simple question: Is a Blood sample considered Personal Data under GDPR?
If you mean the actual sample - no. It’s a physical thing, not data.
If you mean the results of testing then yes if they can identify an individual (like a DNA sequence) or are linked to an identifiable individual and no if they don’t (like they are part of an anonymised database of thousands of results).
From GDPR Article 2:
This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
A blood sample is not "personal data". If information is derived from the sample then that is personal data.
Also, if an organisation collects many blood samples then it must also be collecting associated data, such as when, where, who, why etc. These are certainly personal data, and their linkage with the blood sample makes them more personal because it is reasonable to suppose that future processing (such as analysis of the sample) will create Special Category data.
The GDPR defines bio-metric data as:
“personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person”.
So yes a blood sample would fit. To analyze the data you would most likely be extracting data from it and analyzing it so that would mean you are a processor under the GDPR.
Well, thank you for all your feedback...
Now the answer :)
A Blood Sample is NOT Personal Data, however, it is something similar to a biological Hard Drive, meaning a repository which contains identifiers that constitute Personal Data (DNA; Blood Type; other...).
Personal Data (and someone gave the example of a facial photograph) is any Data that either on its own or when cross-referenced with other Data enabled the univocal identification of a natural person.
In this sense (as an example) a facial photograph on its own allows the univocal identification of a specific natural person, whereas Blood type requires other identifiers or context to be cross-referenced so such identification may occur.