BVerwG - Az. 1 WRB 1.25

Summary

The Federal Administrative Court of Germany ruled that an order for a soldier to present their COVID-19 vaccination certificate was unlawful under both national law and the GDPR. The court classified the inspection and evaluation of vaccination certificates as processing of personal health data, which requires specific exceptions under Article 9 of the GDPR. In this case, the court found no applicable exceptions, as the disciplinary superior was not authorized medical personnel and less intrusive verification methods were available.

Full text

Help BVerwG - Az. 1 WRB 1.25: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 08:42, 9 June 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators14 edits Tag: submission [1.0] Latest revision as of 08:44, 9 June 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators14 editsmTag: Visual edit Line 72: Line 72: The Federal Administrative Court held that there was no legal basis for the order to present the vaccination certificate in national law. In addition, the order was unlawful under the GDPR. The court considered the inspection of a vaccination certificate and its evaluation for the decision on a vaccination order to be processing of personal data. According to the court, a vaccination certificate contains information on the vaccination status of an individual and other health data that can only be processed if one of the narrowly defined exceptions in [[Article 9 GDPR#2|Article 9(2) GDPR]] is applicable. The Federal Administrative Court held that there was no legal basis for the order to present the vaccination certificate in national law. In addition, the order was unlawful under the GDPR. The court considered the inspection of a vaccination certificate and its evaluation for the decision on a vaccination order to be processing of personal data. According to the court, a vaccination certificate contains information on the vaccination status of an individual and other health data that can only be processed if one of the narrowly defined exceptions in [[Article 9 GDPR#2|Article 9(2) GDPR]] is applicable. The court pointed out that German national law allows the personnel of the the medical service of the German Armed Forces to process health data of soldiers for the purposes of preventive medicine within the meaning of [[Article 9 GDPR#2h|Article 9(2)(h) GDPR]]. However, the disciplinary superior was not part of the medical service and therefore not authorised to process health data. The exceptions in Articles 9(2)(b), (g) and (i) were not applicable to the present case either as the necessity requirement was not fulfilled. The court held that the data subject’s vaccination status could have been verified in a procedure less intrusive to the rights and freedoms of the data subject.The court pointed out that German national law allows the personnel of the the medical service of the German Armed Forces to process health data of soldiers for the purposes of preventive medicine within the meaning of [[Article 9 GDPR#2h|Article 9(2)(h) GDPR]]. However, the disciplinary superior was not part of the medical service and therefore not authorised to process health data. The exceptions in [[Article 9 GDPR|Articles 9(2)(b)]], [[Article 9 GDPR|(g)]] and [[Article 9 GDPR|(i)]] were not applicable to the present case either as the necessity requirement was not fulfilled. The court held that the data subject’s vaccination status could have been verified in a procedure less intrusive to the rights and freedoms of the data subject. == Comment ==== Comment == Latest revision as of 08:44, 9 June 2026 BVerwG - Az. 1 WRB 1.25 Court: BVerwG (Germany) Jurisdiction: Germany Relevant Law: Article 9(1) GDPR Article 9(2) GDPR Decided: 26.03.2026 Published: 03.06.2026 Parties: National Case Number/Name: Az. 1 WRB 1.25 European Case Law Identifier: Appeal from: Truppendienstgericht Süd (Germany) Appeal to: Unknown Original Language(s): German Original Source: REWIS (in German) Initial Contributor: av The Federal Administrative Court held ordering a data subject serving in the military to present their COVID-19 vaccination certificate constituted processing of health data. The processing was unlawful as none of the exceptions in Article 9(2) GDPR were applicable. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A disciplinary superior ordered a soldier (the data subject) to provide proof of her COVID-19 vaccination by presenting her vaccination certificate to the disciplinary superior in March 2023. She refused and lodged a complaint against the order in May 2023. The complaint was rejected in a decision in June 2023. The data subject appealed this decision. A military court rejected the data subject’s appeal and held that the order to provide proof of coronavirus vaccination was lawful and binding. The data subject appealed the case further to the Federal Administrative Court and contested the lawfulness of the order. Holding The Federal Administrative Court held that there was no legal basis for the order to present the vaccination certificate in national law. In addition, the order was unlawful under the GDPR. The court considered the inspection of a vaccination certificate and its evaluation for the decision on a vaccination order to be processing of personal data. According to the court, a vaccination certificate contains information on the vaccination status of an individual and other health data that can only be processed if one of the narrowly defined exceptions in Article 9(2) GDPR is applicable. The court pointed out that German national law allows the personnel of the the medical service of the German Armed Forces to process health data of soldiers for the purposes of preventive medicine within the meaning of Article 9(2)(h) GDPR. However, the disciplinary superior was not part of the medical service and therefore not authorised to process health data. The exceptions in Articles 9(2)(b), (g) and (i) were not applicable to the present case either as the necessity requirement was not fulfilled. The court held that the data subject’s vaccination status could have been verified in a procedure less intrusive to the rights and freedoms of the data subject. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Federal Administrative Court 1 WRB 1.25 of March 26, 2026 Declaration of the illegality of an order to submit a vaccination certificate to the disciplinary superior REWIS: LEGAL TECHNOLOGY URL: https://rewis.io/s/u/RYuv/ Database for case law Federal Administrative Court Information provided without guarantee 1st Military Service Senate © REWIS UG (limited liability) 2 1 WRB 1.25 of March 26, 2026 | rewis.io 1 WRB 1.25 of March 26, 2026 Decision | Federal Administrative Court | 1st Military Service Senate Principle There is no sufficient legal basis for an order by a disciplinary superior to submit a private vaccination certificate. ... Ruling The appeal on points of law filed by the applicant is granted, and the decision of the 5th Chamber of the Southern Military Court of November 19, 2024, is set aside. It is determined that the order issued to the applicant by her disciplinary superior to present her vaccination certificate was unlawful. The applicant's costs incurred in the proceedings before the Federal Administrative Court and the Military Court, including necessary expenses incurred in the pre-trial proceedings, are to be borne by the Federal Government. Facts 1. The appeal on points of law concerns the question of whether a disciplinary superior may order a soldier to present her vaccination certificate. 2. The applicant, who has since left the service, was a staff sergeant and a member of the ... in ... 3. On March 20, 2023, her disciplinary superior requested that the applicant provide proof of her COVID-19 vaccination. Based on a notification from the Federal Office for Military Counterintelligence (BAMAD), he suspected that she had provided false information about her vaccination status and still needed to receive the COVID-19 vaccination. Information about her vaccination status was also not eviden

Entities