The complainants were students at an elementary school and a middle school in the summer semester of 2021. A Covid 19 entry self-test or other evidence of low epidemiologic risk was required as a prerequisite for attendance at both schools. The self-tests were administered in class under the supervision of the teacher present. Refusal to self-test and provide (alternative) evidence of low epidemiologic risk resulted in denial of attendance. The test results were not read aloud and the complainants’ evidence was not provided to third parties.
As far as the complaint is directed against the BMBWF, the municipality as well as the teaching staff, it had to be dismissed already because they were not considered as data controllers according to Art. 4 fig. 7 DSGVO in the case at hand. They did not decide on means or purposes of data processing. A synopsis of Section 35 with Annex B of the C-SchVO 2020/21 shows that only the Salzburg Directorate of Education and the school administrators were involved in the data processing at issue and therefore only these were, by definition, considered to be the responsible parties and thus the respondents to the complaint.
Against the background of all these considerations, the data protection authority therefore came to the conclusion that the data processing relevant here can be based on the legal obligation of teachers, standardized in § 44 SchUG in conjunction with § 35 C-SchVO 2020/21, to collect evidence of their low epidemiological risk for the safety of students at school and to enable proper school operation, and represented the most lenient means. Thus, there was a lawful data processing according to Art. 9 para. 2 lit. i GDPR before.
The disclosure of data relevant here therefore proved to be lawful and no violation of the complainants’ right to confidentiality was to be assumed.
The decision is not legally binding.