Bavaria: BayLfD issues joint statement on data processing regarding mask exemptions for health reasons
The Bavarian data protection authority ('BayLfD') issued, on 25 November 2022, a joint statement with the Data Protection Authority of Bavaria for the Private Sector ('BayLDA') on the data processing implications resulting from the exemption to wear a mouth-and-nose covering mask. In particular, the BayLfD stated that a medical certificate, which is required to claim that an exemption based on health reasons applies, should only contain as much information as is necessary to substantiate the reason for exemption to ensure the principle of data minimisation in accordance with Article 5(1)(c) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').
Moreover, the BayLfD clarified that authorised entities can process personal data if an individual claims an exemption from the mask requirement through a medical certificate pursuant to Article 6(1)(e) of the GDPR, whereby the storage of collected and processed data must be carried out in compliance with relevant data protection regulations.
Furthermore, in the employment context, the BayLfD specified that, insofar as an obligation to present a medical certificate can be justified, Article 103 of the Bavarian Civil Service Act provides the legal basis for the processing of personal data in medical certificates by public officials and employers. In this regard, the BayLfD noted that employers must always examine whether the requirements of the legal bases stated therein, in particular with regard to the necessity of data processing, are met on a case-by-case basis.
You can read the statement, only available in German, here.