The communication by a school institution of the vaccination status of a minor student to the mayor of the municipality, in the absence of a specific legal basis, constitutes unlawful processing of health data, even if motivated by the protection of public health.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) published a sanction decision against the Omnicomprensivo Ancel Keys Institute for breaches related to the unlawful communication of health data of a minor student.

The case originated from a complaint by the mother of a student, who reproached the institution for informing the mayor of the municipality about her daughter's exclusion due to non-compliance with the vaccination obligation.

Reasons for the decision

• Obligation to process data lawfully and to have an appropriate legal basis for the processing of personal and health data (Article 5(1)(a), Article 6 and Article 9 of the GDPR): The authority found that the institute communicated to the mayor of the municipality information about the vaccination status of a minor student, which constitutes processing of health-related data. The institute justified this transmission by invoking the mayor's role as a local health authority and practices established during the COVID-19 pandemic, notably to protect another student considered vulnerable. However, the authority ruled that no legal basis, such as a specific legal or regulatory provision, authorized such communication to a third party, in violation of Articles 6 and 9 of the GDPR. The authority recalled that data concerning minors deserve specific protection due to their vulnerability, in accordance with Recital 38 of the GDPR.

Decision of the authority

Consequently, the authority found the processing unlawful and declared an administrative sanction applicable against the Omnicomprensivo Ancel Keys Institute.

Lessons learned

This decision reminds that:

• The legal basis authorizing the collection and internal processing of data (such as vaccination status for school admission) does not automatically constitute a legal basis for their communication to third parties, even if they are public authorities.
• Exceptional procedures implemented during a public health emergency (such as the COVID-19 pandemic) cannot be transposed and used as a legal basis for data processing outside of that specific context.
• The identification of a public authority as having competencies in a domain (for example, public health) is not sufficient to legitimize the communication of personal data; a precise normative provision must explicitly provide for or authorize this transmission.