VG München - M 3 E 22.667

VG München - M 3 E 22.667
Court:	VG München (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(2) GDPR Article 6(3) GDPR Article 79(1) GDPR 16. BayIfSMV
Decided:	04.05.2022
Published:
Parties:
National Case Number/Name:	M 3 E 22.667
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	www.gesetze-bayern.de (in German)
Initial Contributor:	n/a

The Administrative Court München rejected a request for interim relief which was directed against the collection and storing of Covid-19 test certificates by a school, because the legal provisions permitting the school’s conduct were repealed in the meantime.

English Summary

Facts

The controller is an elementary school. The data subjects are pupils of the controller. Under the Bavarian Ordinance on Measures for the Prevention of Infection (16. Bayerische Infektionsschutzmaßnahmenverordnung – 16. BayIfSMV) , the controller required the the data subjects to show Covid-19 test certificates before being allowed to in-person classes. Moreover, pupils were obliged to wear face masks in school if they could not provide an exemption certificate by a doctor. The controller stored the certificates for 14 days, as prescribed by the Ordinance.

On 31 January 2022, the data subjects requested the controller to delete the stored test certificates and stop further collecting them, which was rejected by the controller. Consequently, the data subjects filed an application for interim relief with the Administrative Court of München (Verwaltungsgericht München - VG München) on 10 February 2022 to order the school to stop storing and collecting the test and mask exemption certificates. In its statement of defence, the controller explained that it does not retain any certificates of the data subjects anymore, because it had filed a criminal complaint against the parents of the data subjects with the prosecutor's office on 7 February 2022 because of the suspicion of forgery of documents and had transmitted all the certificates as evidence in the course of the criminal complaint. The data subjects did not contest this statement of the controller.

Holding

The court rejected the application for interim relief in its entirety.

The court held that the application regarding the mask exemption certificates was already inadmissible when the data subjects filed the complaint, because, according to the unconstested statement of the controller, it transmitted all of the certificates to the prosecutor's office and did not store any certificates anymore. The court further reasoned that, because the duty to wear a mask in school was dropped on 2 April 2022, there were no indications suggesting that the data subjects will have to show further certificates in the near term.

Regarding the collection of test certificates, the court also found the application to be inadmissable. The court established that on 30 April 2022, four days before the decision was rendered, the relevant provisions of the 16. BayIfSMV have expired so that there is no duty to show test certificates anymore to participate in classes. The court also found no indications the school will collect test certificates of the data subjects again in the near term, because a reintroduction of the duty was not foreseeable at this time.

Regarding the storing of Covid-19 test evidence the court states the following: Firstly, the court thematizes the applicability of the GDPR because partly persons take the view that other judicial remedies against the data processor and responsible parties are precluded by Art. 79 GDPR. Ultimately the court does not decide whether it is like this. The court goes on to say, that Art. 17 (1) (d) GDPR states the right to deletion in case of unlawful processing of own personal data and that Art. 18 (1) (a), (d) GDPR give a data subject a provisional security claim in the form of a right to restrict processing. Art. 79 (1) GDPR gives a data subject the right to effective remedy so that the claims can be enforced. The court furthermore additionally deems necessary a previous request at the responsible persons. According to the court, in this case the request of the data subjects anyway would have to be understood in such a way that they want to claim their right to delete personal data which was processed unlawfully. The additional request at the responsible parties provided by the court can be seen in the letter of 31 January 2022, according to the court. The court is of the opinion that there is no expected claim of the data subjects against the school on deleting the personal data of the retained and stored Covid-19 test evidence immediately. Regarding Art. 6 (2), (3) GDPR the member states are allowed to determine the processing facts of Art. 6 (1) (c) and (e) GDPR more precisely. The court does not doubt on the legality of collecting the data and storing the test evidence until the expiration of the 16. BayIfSMV which happened with expiration of the 30 April 2022. According to § 4 (1) 16. BayIfSMV pupils among others had to show three times a week a Covid-19 test evidence according to § 3 (5) 16. BayIfSMV if they wanted to participate on lessons that took place in presence. The school has to process the data of the test evidence according to § 4 (1) 16. BayIfSMV for purposes of § 4 (1) 16. BayIfSMV. According to § 4 (1) BayIfSMV the result of the Covid-19 test only is allowed to store for a maximum of 14 days. The Court refers to a jurisdiction of the Bavarian Administrative Court that did not object to identical provisions of the 14. BayIfSMV regarding the right to informational self-determination and regarding Art. 9 (1), (2) GDPR. According to the court, the schools must take care that current tests within the framework of the 16. BayIfSMV were done, so therefore it is necessary that in case the tests are made externally the school processes apart from the kind of test and result also the date and the service provider of the test. The data subjects also do not state that the test evidence contained further data.

Regarding the collection of data and storage of the test evidence after the 30 April 2022 the court states the following: After 30 April 2022 the 16. BayIfSMV is no valid anymore. According to the court it is not clear from § 8 of the 16. BayIfSMV whether the data on the test evidence that were collected and processed before the expiration of the 16. BayIfSMV may also not be stored after the day of its expiration. That the school is allowed to store the results of the test evidence for a maximum of 14 days has the purpose that the school shall take care about the compliance with the restriction and investigate doubtful cases. Therefore, the court does not see why the control of the at that time legitimate restriction should end with the expiration of the 16. BayIfSMV. The court goes on to say that if the data subject contradicts to the data process but a final clarification for temporary safeguarding has not been made yet there is a right to restrict processing through the GDPR. Meanwhile a further storing is according to the court not excluded.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Title:
Right to Desist from Retaining and Preserving Test Evidence
chain of standards:
GDPR 16. BayIfSMV
Keyword:
Right to Desist from Retaining and Preserving Test Evidence
Source:
BeckRS 2022, 11078


tenor

I. The application is rejected.

II. The applicants each have to bear half of the costs of the procedure.

III. The value in dispute is set at EUR 5,000.00.

reasons

1
The applicants are primary school students (hereinafter: the school). In order to participate in face-to-face classes, the applicants regularly provided test evidence in accordance with the provisions of the applicable Bavarian Infection Protection Measures Ordinance.

2
With a brief dated February 10, 2022, received by the court on the same day, the applicants apply through their legal representative to the Munich Administrative Court,

3
to oblige the respondent by means of an interim order to refrain from retaining and storing at the elementary school I. Corona test evidence from the applicants about the result of a PCR or PoC antigen test as well as mask exemption certificates from the applicants in the original or as a copy.

4
In justification, the applicants claim that, according to the school, the test records would be kept for 14 days. Copies of the mask exemption certificates would also be kept by the school. Under what security precautions this happens is unknown. According to data protection regulations, the retention of these documents is illegal and must be avoided. Test certificates and certificates are health data within the meaning of Art. 9 Para. 1 GDPR. The legal basis for examining the test evidence is Section 12 Paragraph 2 Sentence 5, 8 15th BayIfSMV. The term "test result" is used here; a legal basis for storing the test certificate is not apparent. The legal basis for the examination of the mask exemption certificates are §§ 2, 12 para. 1 15. BayIfSMV, whereby there is only one obligation to submit certificates so that they can be checked. Only the result of the check may be documented. A legal basis for keeping the certificates is not apparent. This legal situation would also be referred to in publications by the Bavarian State Commissioner for Data Protection and the Bavarian State Ministry for Education and Culture. In a letter dated January 31, 2022, the applicants unsuccessfully asked the respondent to refrain from keeping the test records and certificates and to delete the test records and copies of the certificates that were kept. The applicants are entitled to a public law injunctive relief according to § 1004 BGB analogously in conjunction with Art. 79 Para. 1, Art. 5 Para. 1 c) DSGVO, Art. 2 BayDSG. Art. 79 GDPR does not block further legal remedies. Applicants cannot be expected to object to their class teacher or headmistress handing over the test certificates. There is therefore still a risk of unlawful processing. Subsequent elimination is not possible due to the lapse of time until a decision on the main issue is available. The unlawful processing of health data represents a serious encroachment on the right to informational self-determination and the general right of personality.

5
In a letter dated February 14, 2022 to the court, the school submitted that test records were kept separately, in particular not in the student file, and not accessible to third parties in the classroom. After 14 days, the test records would be destroyed. The certificates for exemption from the mask requirement in sport were handed over personally by the father of the applicant. They were not presented as originals but as scans, but the school accepted them. After the Christmas holidays, the family had the test evidence back with reference to data protection. On February 7, 2022, the school filed a complaint against the parents of the applicants on suspicion of forgery and submitted the test evidence and scans of the certificates to the police headquarters in Pfaffenhofen an der Ilm. Individual test evidence had previously been submitted to the government of Upper Bavaria, which advised the school to report it. The school no longer had any test certificates or certificates.

6
In a letter dated February 17, 2022, the authorized representative declared the application regarding the retention and storage of the mask exemption certificates to be settled. Otherwise, the application will be maintained, as test evidence will continue to be unlawfully withheld and stored. The school was not authorized to submit test certificates and certificates to third parties such as the government of Upper Bavaria. The test evidence and certificates were not withheld due to suspicion of criminal conduct. The criminal complaint was only made after the lawyer's letter of January 31, 2022 and probably because of it. Even if the forwarding of the test certificates and certificates to the police and the government of Upper Bavaria had been permissible, it would remain inadmissible to retain the test certificates that had previously taken place. It remains unclear on the basis of which objective facts or suspicions a criminal complaint was filed, so that this transmission does not constitute permissible processing in the context of administrative offense or criminal proceedings.

7
In a letter dated March 31, 2022, the state school authority in the district of Pfaffenhofen an der Ilm announced that, in consultation with the school, the partial settlement was not approved. There is no completing event. The application was inadmissible or unfounded from the outset, since the certificate had already been handed over to the police on February 7, 2022. According to the attached statement from the school dated February 25, 2022, the parents of the applicants had submitted the test certificates to the class teacher by January 21, 2022. When the school had questions about the test evidence, the school management contacted the parents. Since there was another clear indication that something could not be right with the test evidence, the headmistress briefly questioned the applicants about their tests. The parents of the applicants then filed a complaint against the headmistress; the applicants subsequently informed the class teacher that the school was not allowed to keep the test records and was not allowed to make copies. The school may process a student's name, address and date of birth. This data can be found on the test record. Furthermore, the test date must be noted on the test certificate to check whether the test result of a quick test is not older than 24 hours. The certified body and the test result must also be entered.

8th
In a brief dated April 25, 2022, the applicants essentially assert that there is no further evidence that the applicant's test certificates are falsified or incorrect in terms of content. On closer inspection, the alleged incident on January 21, 2022 turns out to be an unfounded suspicion, since the parents of the applicants have explained in a comprehensible manner that the Allianz letterhead ended up on the test certificates simply by accidentally printing out the test certificates sent by e-mail on company paper be. In any case, this does not justify the permanent storage of all test evidence without cause.

9
Reference is made to the court file for further details on the facts and the status of the dispute.

10
1. The application is unsuccessful.

11
a) With regard to the applicant’s unilateral declaration of resolution, insofar as it was requested to oblige the respondent to refrain from withholding and storing the applicant’s mask exemption certificates, it was necessary to determine whether the main issue was resolved. This is not the case.

12
Due to the unilateral declaration of completion by the applicant, the subject of the application procedure is only the question of whether the main issue has been resolved (BayVGH, B.v. 1.12.2003 - 3 CE 03.2098 - NVwZ-RR 2004, 623 with further references; Schoch in Schoch/Schneider, VwGO, Status July 2021, § 123 para. 131c). Completion is to be assumed if an extra-procedural event that occurs after the application has been filed means that the basis for the application is withdrawn, in particular if the court decision can no longer bring any legal advantage to the party making the application. If the requesting party has issued a declaration of completion, which the respondent does not agree to, this declaration is to be interpreted as a - permissible - application for determination of the occurrence of completion without express conversion of the original application (BayVGH, B.v. 1.12.2003 - 3 CE 03.2098 - NVwZ-RR 2004, 623 with additional information).

13
In the present case, no settlement has occurred. With regard to certificates from the applicants for exemption from the mask requirement, the application was already inadmissible at the time of application due to a lack of legal protection. Because at the time the application was submitted on February 10, 2022, the school no longer had any certificates from the applicants about the exemption from the mask requirement. After the school submitted an unchallenged statement, it forwarded the submitted scans of the applicant’s certificates to the police on February 7, 2022; There are no indications that the school still has the original or a copy of the certificates.

14
At the time the application was submitted, the application was also not to be interpreted as an application for preventive temporary legal protection with regard to any certificates that may have to be submitted in the future (Section 122 (1) in conjunction with Section 88 VwGO), since such an application would not have been permissible either. A prerequisite for an interest in legal protection in this regard would be that there is a risk of a concrete violation of the law and regular subsequent legal protection is not sufficient (Happ in Eyermann, VwGO, 15th ed. 2019, § 42 marginal number 67). In the present case, it was neither demonstrated nor apparent that further certificates in connection with an exemption from the mask requirement would have to be submitted in the foreseeable future.

15
Because at the end of April 2, 2022, the obligation to wear a mask for lessons and other school events and for lunchtime care at schools will no longer apply (cf. Section 8 Paragraph 1 Clause 1, Section 2 Paragraph 3 Clause 1 No. 2 in conjunction with Section 12 Fifteenth Bavarian Infection Protection Measures Ordinance - 15th BayIfSMV - of November 23, 2021, BayMBl. No. 816, BayRS 2126-1-19-G, last amended by regulation of March 18, 2022, BayMBl. No. 176). There are currently no indications that the mask requirement will be reintroduced in the near future.

16
b) If the applicant applies for the respondent to be ordered by way of a temporary injunction to refrain from withholding test evidence of the result of a PCR or PoC antigen test at the school, the application is inadmissible due to the lack of legal protection.

17
At the end of April 30, 2022, the Sixteenth Bavarian Infection Protection Measures Ordinance (16th BayIfSMV) of April 1st, 2022 (BayMBl. 2022 No. 210) and thus also § 4 Para. 1 Sentence 1 16th BayIfSMV expired, according to which participation Pupils were only allowed to take part in face-to-face classes, other school events or school holiday courses in attendance, as well as lunchtime and emergency care, if they could provide proof of a test three times a week or, under supervision, take a self-test provided by the school and used there with a negative result result had made. Since there is currently no longer any reason to submit test evidence for participation in face-to-face classes, it is not apparent that the school could again withhold test evidence from the applicant. There is no need for legal protection for an application for preventive interim legal protection with regard to any future submission obligations of the applicant, since it is currently not foreseeable that regulations on the submission of test certificates as an admission requirement for face-to-face teaching would be introduced again.

18
c) Insofar as the applicant applies for the respondent to be ordered by way of an injunction to refrain from keeping test evidence of the result of a PCR or PoC antigen test at the school, the application is admissible.

19
aa) The application is also permissible with regard to the applicability of the General Data Protection Regulation (Art. 2 Para. 1 GDPR, Art. 2 Sentence 1 BayDSG). It is partly assumed that in the area of application of the General Data Protection Regulation, the legal protection system also has its starting point in the General Data Protection Regulation and Art. 79 GDPR excludes further legal remedies against controllers and processors. The rights of those affected are laid down in Chapter III of the GDPR (Art. 12 to 22 GDPR); beyond this, the General Data Protection Regulation does not grant any rights for the enforcement of which an effective legal remedy under Art. 79 GDPR must be made available (VG Regensburg, GB of August 6th, 2020 - RN 9 K 19.1061 - juris marginal number 19; a.A. VG Wiesbaden, B.v. December 1, 2021 - 6 L 738/21.WI - juris para. 32 ff.). However, Art. 17 Para. 1 Letter d GDPR conveys a right to erasure if (own) personal data is processed unlawfully, and Art. 18 Para. 1 Letter a, d GDPR a provisional security claim in the form of a right to restriction of Processing. In order to enforce these claims, Art. 79 Para. 1 GDPR gives a right to an effective legal remedy; In addition, according to general procedural law, a prior application to the person responsible should be required (VG Regensburg, GB of August 6, 2020 - RN 9 K 19.1061 - juris marginal note 25 with further references). Even if one follows the view that there is no longer any room for a general claim for injunctive relief and for the elimination of consequences to be regulated by means of an application under § 123 VwGO, the application of the applicant would be to be understood as asserting their right to deletion of unlawfully processed personal data; a corresponding prior application to the person responsible should be seen in the letter from the applicant's representative to the school dated January 31, 2022. Thus, in the present case, it can remain open whether the public-law injunctive relief or claim for the elimination of consequences can still be asserted in court.

20
bb) However, the application is unfounded.

21
According to Section 123 (1) sentence 2 VwGO, the court can issue an interim order to regulate a provisional situation in relation to a disputed legal relationship if this regulation appears necessary to avert significant disadvantages, to prevent imminent violence or if there are other reasons. The prerequisite is that the applicant credibly demonstrates the right he or she claims (right to order) and the imminent risk of impairment (reason for order) (Section 123 (3) VwGO in conjunction with Section 920 (2) ZPO). If the requested temporary injunction anticipates the decision on the main issue in terms of content and timing, the application is only to be granted if this is necessary to ensure effective legal protection and there is a high degree of probability that the claim pursued with the main issue is justified (BVerwG , U.v.18.4.2013 - 10 C 9/12 - juris para. 22).

22
Measured against this, the issuance of a temporary injunction is out of the question. The applicants have not made any credible claim for an order in this regard.

23
The applicants probably have no claim against the school as the controller (Art. 3 Para. 2 BayDSG) to immediate deletion of the personal data on the retained and stored test records (Art. 17 Para. 1 Letter c GDPR).

24
Art. 17 (1) (c) GDPR also opens up to provisions of national law via the implicit reference to Art. 6 GDPR; According to Art. 6 Para. 2, 3 GDPR, the national legislators have the possibility to specify the processing facts of Art. 6 Para. 43).

25
(1) According to this, there should be no legal objections to collecting the data and storing the test evidence, at least until the 16th BayIfSMV expires on April 30, 2022.

26
(a) § 4 Paragraph 1 Sentence 1 16. BayIfSMV provided that participation in face-to-face classes, other school events or school holiday courses in presence, as well as lunchtime and emergency care for pupils is only permitted if they can provide proof of a test three times a week § 3 para. 5 sentence 1 no. 1, 2 16. BayIfSMV provide. According to § 4 paragraph 1 sentence 5 16th BayIfSMV, the school processes the test result for the purposes according to § 4 paragraph 1 sentence 1, 2 16th BayIfSMV. According to § 4 paragraph 1 sentence 8 BayIfSMV, the test result is kept for a maximum of 14 days. According to the case law of the Bavarian Administrative Court on the identical provisions in Section 13 (2) sentences 1, 5 and 8 14th BayIfSMV, these provisions should not apply either in relation to the right to informational self-determination or in relation to Art. 9 (1), 2 GDPR to be objectionable (BayVGH, B.v. 4.11.2021 - 25 NE 21.2634 - BeckRS 2021, 36742 Rn. 39 ff. with further references).

27
(b) Insofar as the applicants assert that Section 4 (1) sentence 5, 8 16th BayIfSMV only contains the authority to process the test result for the purposes of Section 4 (1) sentence 1, 2 16th BayIfSMV and for a maximum of 14 Keeping days, but not withholding and keeping the test record itself, doesn't get through to them.

28
The provision of proof of a test by pupils as a prerequisite for admission, in particular for face-to-face teaching combined with the authority of the school to process and store the test result, was introduced with the ordinance amending the Twelfth Bavarian Infection Protection Measures Ordinance of April 9, 2021 (BayMBl. 2021 No. 261). The provisions of the then § 18 paragraph 4 sentences 2 to 5 12th BayIfSMV had the following wording:

29
"For this purpose, the pupils must have a written or electronic negative result of a PCR or POC antigen test at the beginning of the school day and present this on request, or they must have carried out a self-test with a negative result under supervision at school. The test on which the test result is based or the self-test carried out at school may have been carried out no more than 48 hours, in the case of paragraph 1 sentence 3 no. 1 no more than 24 hours before the start of the respective school day. If tests are carried out in the school, the school processes the test result exclusively for the school purpose of maintaining face-to-face teaching; A transmission to third parties does not take place, subject to reporting obligations under the Infection Protection Act. The test result will be kept for a maximum of 14 days.”

30
§ 18 paragraph 4 sentence 2 12. BayIfSMV obliges the students to present a written or electronic negative "result" of a PCR or PoC antigen test; the authority to retain data for a maximum of 14 days in accordance with Article 18 Paragraph 4 Sentence 5 12. BayIfSMV also refers to the "test result". Thus, in Section 18 (4) sentence 2 12th BayIfSMV, “result” (of a PCR or PoC antigen test), as can be seen from the addition “written or electronic”, is used synonymously with “test evidence”, which is also reflected in the justification of the Amending Ordinance (BayMBl. 2021 No. 262, p. 5) shows when it states: “If there is distance learning at the school for the respective grade, the students who cannot or do not want to prove a negative corona test are , obliged to take part in distance learning”. Thus, at the time the rules were introduced, there was no literal distinction between the information that students had to provide about the external test and the data that the school was allowed to keep for a maximum of 14 days. Whether the standard-giver with the distinction introduced in the thirteenth Bavarian Infection Protection Measures Ordinance (13th BayIfSMV) of June 5, 2021 (BayMBl. 2021 No. 384) between the "test proof" to be provided by the students (§ 20 Para. 2 Sentence 1 13. BayIfSMV) and the "test result", which is kept for a maximum of 14 days (§ 20 Para. 2 Sentence 3 13th BayIfSMV) wanted to regulate something else in the matter, seems questionable. On the one hand, the justification speaks against this (BayMBl. No. 385, p. 7): "§ 20 paragraph 2 regulates the details of the required test certificates and continues the regulation of § 18 paragraph 4 in terms of content". There is no mention of a change in the form of a substantive differentiation between “test evidence” and “test result” in Section 20 (2) sentence 3 of the 13th BayIfSMV. On the other hand, Section 20 (2) sentence 3 13th BayIfSMV regulates the storage of test data, regardless of whether an external test or a school test was carried out; however, the distinction between “test evidence” and “test result” is irrelevant in the case of testing in schools, which is accepted as the norm by the standard-giver.

31
Above all, however, it is not clear to what extent, when external tests are carried out, these differences in the wording result in an actual difference in terms of the scope of the data that the school may store for a maximum of 14 days.

32
The test result is processed in accordance with Article 4, Paragraph 1, Clause 5 of the 16th BayIfSMV for the purposes of Article 4, Paragraph 1, Clause 1 and 2 of the 16th BayIfSMV. Storage pursuant to Section 4 (1) sentence 8 16th BayIfSMV must not be carried out in a manner that is incompatible with these purposes (Article 5 (1) (b) GDPR) and must be limited to what is necessary for the purposes of processing (Article 5 (1) (c) GDPR). The purposes of processing according to Art. 6 Para. 3, 4 DSGVO also include the exercise of control powers (Art. 6 Para. 1 BayDSG).

33
In order to be able to monitor compliance with the access restriction (current negative test result) for students who do not take part in school tests, the schools must be able to check whether a test within the meaning of Section 4 (1) sentence 1 in conjunction with Section 3 (5) sentence 1 No. 1, 2 16. BayIfSMV was made and whether it is up to date. The school must also be able to check whether the test was carried out by a service provider in accordance with Section 6 Paragraph 1 of the Coronavirus Test Ordinance or was monitored on site (Section 4 Paragraph 1 Clause 1 in conjunction with Section 3 Paragraph 5 Clause 1, No 1, 2 16. BayIfSMV, Section 22a Paragraph 3 No. 3 IfSG, Section 6 Paragraph 1 Coronavirus Test Ordinance). Against this background, external tests not only require documentation of the type and result of the test, but also of the test date and the respective service provider.

34
It is not clear from the submissions of the applicants that and what additional information the test evidence submitted by the applicants and retained and stored by the school contained.

35
Insofar as the applicants continue to object to what they consider to be insufficient protection of the test certificates against unauthorized access, the school stated in a letter dated February 14, 2022 that the test certificates would be kept separately and not accessible to third parties in the classroom and after a period of 14 days destroyed. Concrete indications that this argument would be inaccurate have not been submitted by the applicants or are otherwise apparent.

36
(2) Insofar as the application is directed against the storage of the test evidence beyond April 30, 2022, a claim to omission of further storage or deletion, which can be enforced by way of a temporary injunction, has not been made credible.

37
According to Section 8 of the 16th BayIfSMV, the 16th Bavarian Ordinance on Protection against Infections, and with it the authority of the school to store the test results for a maximum of 14 days, as regulated in Section 4, Paragraph 1, Clause 8 of the BayIfSMV, expired on April 30, 2022. Whether the storage of student data on tests that were previously collected and processed in accordance with Section 4 Paragraph 1 Clause 1, 5, 8 16th BayIfSMV must end at the end of April 30, 2022 (even before the end of a maximum of 14 days). , does not result from § 8 16. BayIfSMV.

38
According to Art. 17 Para. 3 Letter b, Alt. 2 GDPR, there is no right to the deletion of unlawfully processed data if the processing is necessary to perform a task that is in the public interest or in the exercise of official authority that responsible has been transferred. This should be considered here because the purpose of storing the test results for a maximum of 14 days is to enable the school to monitor compliance with the access restriction and to investigate any cases of doubt. In the present case, it is not clear why the control of the access restriction that was still valid until April 30, 2022 must also end at the end of April 30, 2022.

39
It should also be noted that Art. 18 Para. 1 Letter d GDPR in cases in which the data subject has lodged an objection to the processing pursuant to Art. 21 Para. 1 GDPR only grants a right to restriction of processing, as long as not it has been established whether the legitimate reasons of the person responsible outweigh those of the data subject. If the processing has been restricted in accordance with Art. § 18 Para. 1 GDPR, this personal data - apart from its storage - may only be used with the consent of the person concerned or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or are processed for reasons of important public interest of the Union or a Member State (Article 18 (2) GDPR).

40
This means that according to the General Data Protection Regulation, if the person concerned objects and before a final clarification for the purpose of provisional security, only a right to restriction of processing is provided, which does not rule out further storage.

41
Against this background, there are considerable doubts about the asserted claim for an order, since the omission of further storage sought by the applicants by way of an interim order is directed precisely against further storage and in this respect also anticipates the main issue.

42
2. The application was therefore to be rejected with the cost consequences of Section 154 Paragraph 1, Section 159 Sentence 1 VwGO.

The determination of the amount in dispute is based on Section 53 Paragraph 2 No. 1, Section 52 Paragraph 1, 2 GKG in conjunction with No. 1.1.3, 1.5, taking into account the preliminary character of the procedure. of the value in dispute catalog for administrative jurisdiction.