Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses collection of sensitive personal information categories including political and religious beliefs, sexual orientation, racial or ethnic origin, union membership, medical records, disability information, government identifiers such as social security numbers, and passport or driver's license numbers.
This analysis describes what Thomson Reuters's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Thomson Reuters collects multiple categories of special category data under GDPR Article 9, sensitive personal information under CCPA/CPRA, and analogously protected categories under other data protection frameworks, each of which imposes heightened lawful basis, consent, and data subject rights requirements beyond those applicable to ordinary personal data.
Under this clause, Thomson Reuters collects political and religious beliefs, sexual orientation, racial and ethnic origin, union membership, health and medical records, disability status, and government identification numbers. California residents may limit the use of sensitive personal information through the opt-out mechanism described in the statement.
Cross-platform context
See how other platforms handle Sensitive Personal Information Collection and similar clauses.
Compare across platforms →Monitoring
Thomson Reuters has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Demographic information Age; date of birth; marriage status; gender; physical characteristics; military status; political, religious, or philosophical beliefs; sexual orientation; racial or ethnic origin; and union membership... Health, benefits, and insurance information Enrollment and participation in insurance or benefits programs; personal information of beneficiaries, family members, emergency contacts, or dependents; medical records; and disability information... Identity information Government identification and governmental identifiers, such as tax identifiers, social security or national insurance numbers, and passport or driver's license numbersExcerpt from Thomson Reuters's Privacy
1) REGULATORY LANDSCAPE: GDPR Article 9 prohibits processing of special category data including political opinions, religious beliefs, sexual orientation, racial or ethnic origin, trade union membership, and health data except under enumerated lawful bases, most commonly explicit consent or employment necessity. CCPA/CPRA designates government identifiers, health data, racial or ethnic origin, religious beliefs, sexual orientation, and union membership as sensitive personal information subject to opt-out rights and use limitation. Illinois, Texas, and other states impose additional restrictions on specific sensitive categories. 2) GOVERNANCE EXPOSURE: High. The breadth of sensitive categories collected, spanning both employment-context data (medical, disability, union, government ID) and behavioral or demographic profiling categories (political, religious beliefs, sexual orientation), creates a complex multi-framework compliance obligation. GDPR enforcement actions related to special category data processing have resulted in significant regulatory penalties across EU member states. 3) JURISDICTION FLAGS: EU and UK operations face the highest exposure for special category processing under GDPR Article 9 and UK GDPR. California CPRA's sensitive personal information regime imposes use limitation rights. Illinois BIPA intersects with biometric data that may accompany some sensitive category processing. South Africa's POPIA and Brazil's LGPD impose analogous special category protections. 4) CONTRACT AND VENDOR IMPLICATIONS: Employer customers whose employee data is processed through Thomson Reuters HR or benefits-related services should confirm that Thomson Reuters' processing of health, disability, and government identifier data is covered by appropriate data processing agreements specifying the lawful basis, retention periods, and access controls applicable to sensitive categories. 5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that explicit consent or another GDPR Article 9 lawful basis is documented for each sensitive category processed in EU and UK jurisdictions. CCPA/CPRA compliance teams should verify that the sensitive personal information opt-out mechanism covers all listed sensitive categories and that internal data maps accurately reflect the flow and use of sensitive data across Thomson Reuters products.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that Thomson Reuters collects multiple categories of special category data under GDPR Article 9, sensitive personal information under CCPA/CPRA, and analogously protected categories under other data protection frameworks, each of which imposes heightened lawful basis, consent, and data subject rights requirements beyond those applicable to ordinary personal data.
Under this clause, Thomson Reuters collects political and religious beliefs, sexual orientation, racial and ethnic origin, union membership, health and medical records, disability status, and government identification numbers. California residents may limit the use of sensitive personal information through the opt-out mechanism described in the statement.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Thomson Reuters.