Health data in passenger transport: what Article 9 GDPR means for patient and disability transport

Article 9 GDPR inverts the usual test. For ordinary data you look for a legal basis under Article 6 and you are done. For special categories, paragraph 1 starts with a prohibition. Processing only becomes permissible if one of the exemptions listed exhaustively in paragraph 2 also applies. Both layers have to hold.

There is one point where operators get stuck particularly often. The usefulness of an entry does not create a permission. The fact that dispatch plans better when it knows the reason for a slow boarding process does not make recording that reason lawful. The test runs through the action required, not through the underlying cause.

Classification as a special category brings three duties that smaller operators often assume do not apply to them.

• The record of processing activities becomes mandatory. The relief for organisations with fewer than 250 employees under Article 30(5) GDPR falls away as soon as special categories are processed.
• A data protection impact assessment under Article 35(3)(b) GDPR comes into play where processing is carried out on a large scale. With several hundred passengers, that is a question worth taking seriously.
• The technical and organisational safeguards under Article 32 GDPR are made concrete for sensitive data by section 22(2) BDSG, among other things through access restrictions, encryption, pseudonymisation and training.

Article 4(15) GDPR defines health data as personal data that reveal information about a person’s state of health. Recital 35 reads this broadly and expressly names disabilities, disease risks and medical treatment. Whether a field sounds medical is irrelevant. What matters is whether it allows a conclusion about health to be drawn.

The Merkzeichen in the second-to-last row are a good example of an entry that looks harmless. Under section 3 of the Schwerbehindertenausweisverordnung (the German regulation on severely disabled passes), aG stands for exceptional walking impairment, Bl for blindness, H for helplessness. Two letters in the approval field therefore carry a medical statement.

Harder than the form fields are the places where such data arise as a by-product.

• Free-text fields. ‘Needs two minutes, prone to circulatory problems’ is health data, even if it was only typed quickly into the notes box.
• Attachments and scans. A funding approval notice regularly contains more health information than all the form fields next to it put together.
• Destinations. A recurring journey to dialysis reveals the reason for treatment without anyone having entered it.

A workable construction has two layers. Underneath sits a legal basis under Article 6 GDPR, regularly paragraph 1(b) for the transport contract, or (c) or (e) for journeys commissioned by a Sozialleistungsträger (a public social benefits provider). Above it sits Article 9(2).

What is usually relied on there is Article 9(2)(h) GDPR, which permits processing for the purposes of preventive health care and for the provision of health or social care, provided it rests on member state law. That national basis is supplied by section 22(1) no. 1(b) BDSG, which expressly applies to public and private bodies alike. Article 9(3) GDPR comes on top of it. Only people bound by professional secrecy or an equivalent obligation of confidentiality may carry out the processing. Dispatchers, drivers and temporary staff therefore have to be placed under a written confidentiality obligation, and that is a condition of the permission itself. If the signed undertaking is missing from the personnel file, the permission is missing one of its conditions.

How the classification turns out in an individual case depends on the contractual set-up. Whether you act on your own responsibility or as a processor under Article 28 GDPR for a Kostenträger (the body funding the journey) determines the legal basis, the paperwork and who gives instructions. Where social data are processed on behalf of a social benefits provider, section 80 SGB X (Book X of the German Social Code) also applies, which among other things requires prior notification of the supervisory authority. Settle the allocation of roles in writing and have it confirmed from a data protection perspective. This article is no substitute for legal advice in an individual case.

Where consent is a sensible addition

Article 9(2)(a) GDPR permits processing on the basis of explicit consent. As the sole anchor it rarely works, because under Article 7(3) GDPR consent can be withdrawn at any time, and a withdrawal should not be able to remove an entry that safety depends on. Its place is where processing goes beyond what is necessary. An additional information channel to a daughter who wants to know every day whether her father has arrived is exactly such a case.

Data minimisation under Article 5(1)(c) GDPR bites hardest here, because every additional field raises the risk. The guiding question when designing the form is what the driver has to do and what equipment the vehicle needs for it. A diagnosis does not answer that. It describes a cause from which every driver would have to work out for themselves what to do. The most sensitive information circulates and the instruction is still missing.

Four changes to the form do most of the work.

• The free-text field ‘illness, diagnosis’ becomes a picklist ‘support required when boarding and alighting’.
• ‘Type of disability’ becomes entries on restraint system, mobility aid and space requirement.
• The medication overview becomes an emergency note that states what to do and who to inform.
• ‘Medical history, pre-existing conditions’ becomes the field ‘escort required: yes, no, depends on the situation’.

Offer free-text fields and you will get free text. Picklists with a small number of care and equipment attributes keep the data volume down and, unlike running text, can be hidden by role. A free-text field should still exist. Its label then has to make clear that what goes there are instructions for action, not medical histories.

Section 22(2) BDSG expressly names access restrictions as an appropriate and specific measure for special categories. This requirement is not a recommendation. In practice it means that each role in the operation gets to see only a slice of the passenger record.

Dispatch works with care and capacity attributes, time windows and the accessibility of the address. It does not need emergency medication in detail, diagnoses, or approval notices in full text. Billing manages with approval status, journey records, kilometres and times. Management and the data protection officer access records in a justified individual case, with an audit trail, rather than having every free-text entry permanently open.

The assigned driver is the most important case and the one most often solved wrongly. He needs the instructions for his tour, the emergency contact and the handover arrangements, and he needs them on the day of the journey. He does not need a complete record, and certainly not entries about passengers on other tours. Printed tour lists and messenger groups fail at this boundary systematically, because they know no roles, only recipients. Once distributed, a list stays distributed.

This is precisely where dispatch software helps if it ties visibility to role and tour assignment, logs access, and separates the channel for relatives from the operational system. At Vermo, dispatch and the driver app are cut along this role logic, as is the access for parents and carers.

• For every role it is set down in writing which field it sees and for what purpose.
• Drivers see passenger data only for assigned tours within the relevant period.
• There is a log of who opened a passenger record.
• All staff are placed under a written confidentiality obligation and trained.
• Access is withdrawn immediately when someone leaves, temporary staff included.

Disclosure to funding bodies, relatives and service providers

Every disclosure is a processing operation in its own right and needs its own justification. The fact that someone belongs to the passenger’s circle is no substitute. Towards funding bodies, what is permissible is what is necessary for billing and proof of service, meaning approval status, journey data and the agreed records. The emergency note is not part of that. Which entries actually support an approval is covered in the article on approval and Pflegegrad for patient journeys.

With relatives and carers, the telephone is the most common weak point. Anyone who calls and sounds plausible gets information in many places. Legally, though, what counts is not the relationship but the authority, meaning parental responsibility, a rechtliche Betreuung (court-appointed legal guardianship) with a matching scope of duties, or a power of attorney. An adult passenger decides what their children get to know, not the other way round.

1. Establish identity. Calling back on a number already on file is the simplest protection against giving information to unauthorised people.
2. Check the authority. Is there documented authority to act, or is a relationship simply being assumed?
3. Limit the scope. A pickup time is not information about someone’s state of health.
4. Note the disclosure. Without documentation, the accountability duty under Article 5(2) GDPR cannot be met.

Disclosure also covers the use of external service providers. Anyone using software, hosting or telematics has to settle the roles between controller and processor and conclude a contract under Article 28(3) GDPR. With tracking systems, the same question arises again for the workforce, which is covered in the article on GPS tracking and the works council.

A single retention period for all passenger data does not work, because two kinds of data sit side by side in the record. Billing and evidence documents are subject to commercial and tax retention duties, whereas sensitive free-text entries are only subject to purpose limitation. Treat both the same way and you either store too long or delete what you would need to prove in a dispute.

1. Separate the data types. Decide which fields serve as evidence and which only serve the safe execution of the journey.
2. Assign the retention duties. Under section 147(3) AO (Abgabenordnung, the German Fiscal Code), books and records must be kept for ten years, accounting vouchers for eight years and other documents for six years; section 257(4) HGB (Handelsgesetzbuch, the German Commercial Code) contains the parallel commercial law periods. Both concern the billing document, not the free text beside it.
3. Define the purpose of the sensitive fields. An emergency note serves the safe execution of the journey. Once transport ends for good, that purpose falls away, and any further storage needs its own justification.
4. Anchor deletion and log it. Record who deletes or anonymises which data type and when, and document that it actually happened. A rule nobody carries out is no help in an audit.