DPA case 95/2023 – Order (Belgium, 2023)

The controller was a dancing school which refused to re-enroll a person because she did not want to confirm whether or not she had been vaccinated against Covid-19. Considering that the controller did not have a legal basis to ask for her vaccination status, the person filed a complaint with the Belgian DPA.The controller denied ever having requested this information, it stated that it had only recommended members to vaccinate based on the French Interfederal Sports Association's recommendation. The Belgian DPA started by clarifying that since the complainant had not shared her vaccination status, no processing of personal data had taken place. Even though the complainant could not be considered as a data subject within the meaning of Article 4(1) GDPR, this lack of processing however, did not deprive her of her right and interest to submit a complaint with the DPA. The DPA stated that, considering that a vaccination status could qualify as sensitive health data under Article 9(1) GDPR, it is in principle forbidden to process. Article 9(2) sets out the exceptions to this principle, these conditions must be read in conjunction with the required legal basis as defined in Article 6. Unlike other cases in which the DPA has found one or other breach even in the absence of processing, in this case the DPA considered that there was not enough evidence that this information was actually requested. Consequently, the DPA dismissed the case.