German Court Rules Military COVID Certificate Order Violated GDPR Health Data Protections

The German Federal Administrative Court determined that a military superior's order to present COVID-19 vaccination certificates constituted unlawful processing of sensitive health data under GDPR Article 9. The court found no legal basis for the data processing request and confirmed that none of the special category data exceptions applied to this situation. This ruling highlights the critical importance of establishing proper legal grounds before processing health information, even in organizational or employment contexts. Organizations must carefully evaluate their authority and legal basis before requesting or processing any health-related personal data from individuals.

Tactical Insight

Immediate actions

Conduct legal review of all current health data collection practices and policies
Suspend any health data processing activities lacking clear legal basis under GDPR Article 9
Train supervisors and HR personnel on GDPR requirements for processing special category data

Long-term improvements

Establish formal data processing impact assessments (DPIAs) for all health data collection
Develop clear policies defining when and how health data may be lawfully processed
Implement approval workflows requiring legal review before collecting sensitive personal data

Compliance measures

Maintain documented legal basis for all personal data processing activities
Create employee privacy notices clearly explaining health data processing purposes and legal grounds
Establish regular audits of data processing activities to ensure ongoing GDPR compliance