Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data bans the processing of medical data owing to their highly sensitive nature. Fortunately the Directive provides that this ban does not apply in seven cases. The paper aims first to explain the reasons for this ban. Then it describes the conditions under which medical data may be processed under European Law. The paper investigates notably the strengths and weaknesses of the data subject's consent as base of legitimacy for the processing of medical data. It also considers the six other alternatives to legitimate the processing of medical data.