(152)The processing of certain categories of sensitive data as defined under Article 9 of Regulation (EU) 2016/679 could give rise to risks to the fundamental rights and freedoms of the subjects of those data. To minimise the risks that the processing of such data by obliged entities results in discriminatory or biased outcomes that adversely impact the customer, such as the termination or refusal to enter into a business relationship, obliged entities should not take decisions solely on the basis of information in their possession concerning special categories of personal data within the meaning of Regulation (EU) 2016/679 where that information bears no relevance to the money laundering and terrorist financing risks posed by a transaction or relationship. Similarly, in order to ensure that the intensity of customer due diligence is based on a holistic understanding of the risks associated with the customer, obliged entities should not base the application of a higher or lower level of customer due diligence measures solely on the basis of sensitive data that they possess on the customer.