The administrative capacity to manage the effects of the COVID-19 pandemic in schools: legality of personal data processing concerning the staff vaccination status in order to resume courses with physical presence or online*

Abstract

The administrative capacity of public authorities and bodies, as well as of the institutions under their subordination/in their coordination, includes, not only all material, institutional and human resources, but also the actions they carry out for the exercise of the competencies established by law. In the context of the COVID-19 pandemic, the Minister of Education together with the Minister of Health issued Joint Order no. 5558/2389/2021 which provided that, starting with 8 November 2021, the resumption of courses with physical presence is to take place in all pre-university education units in which a minimum percentage of 60% of the staff is vaccinated, otherwise the resumption of courses will be done online, and the Boards of Directors of the pre-university education units issue the decision on how to resume the courses. Therefore, this study will analyse, in the light of data protection legislation, if, in view of the competencies established by law, the pre-university education units had the necessary administrative capacity to issue an informed decision on how to resume the courses. The main conclusion after analysing the legal framework is that the legitimate basis for personal data processing concerning the staff vaccination status can only be point (c) of Article 6 (1) and point (g) of Article 9 (2) of Regulation (EU) 2016/679, but the Joint Order no. 5558/2389/2021 does not fall into either of these two legal basis for the processing, with the consequence that the Boards of Directors were in fact deprived of the necessary administrative capacity to issue the decision on how to resume the courses.