Judgment;Summary — ECLI:EU:C:2023:745
Date: 2023-10-05
Language of the case: Czech
Court formation: Eighth Chamber
Subject matter: Citizenship of the Union;Right of entry and residence;Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Czechia

Summary C-659/22 – 1 
Case C-659/22 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
20 October 2022 
Referring court:  
Nejvyšší správní soud (Czech Republic) 
Date of the decision to refer:  
12 October 2022 
Applicant: 
RK 
Defendant: 
Ministerstvo zdravotnictví (Czech Ministry of Health) 
  
Subject of the main proceedings and of the request for a preliminary ruling  
The original proceedings concern an application for the annulment of the 
defendant’s measure 1 subject to which the applicant was obliged, upon entering 
certain premises, to document his compliance with infection-free conditions. 2 
 
1 Mimořádné opatření ze dne 29.12.2021, MZDR 14601/2021-34/MIN/KAN (Extraordinary 
measure of 29 December 2021, MZDR 14601/2021-34/MIN/KAN) (‘the extraordinary 
measure’). 
2 (i) The taking a PCR test, to test for the presence of the SARS-CoV-2 virus with a negative 
result that is not older than 72 hours for specific categories of persons; or (ii) the expiration of at 
least 14 days after the completion of the vaccination scheme using an approved medicinal 
product; or (iii) having undergone the Covid-19 disease as confirmed by a laboratory, with the 
expiration of the isolation period and a time-limit of 180 days since the first positive test 
(‘infection-free status’).  
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-659/22 
 
2  
Anonymised Version 
The referring court is considering the question whether checks of compliance with 
the conditions of an infection-free status contained in the EU Covid digital 
certificates, 3 which are used for national purposes, via the defendant’s mandatory 
mobile application, falls within the material scope of the GDPR Regulation. 4 
Question referred for a preliminary ruling 
‘Does the verification, using the national ‘čTečka’ application, of the validity of 
interoperable Covid-19 vaccination, test, or recovery certificates, issued pursuant 
to the [Digital Certificates] Regulation, which are used by the Czech Republic for 
national purposes, amount to automated processing of personal data pursuant to 
Article 4, point (2), of the [GDPR] Regulation, and hence, is the material scope of 
the [GDPR Regulation] thus established, pursuant to Article 2(1) of that 
Regulation?’ 
Provisions of European Union law relied on  
GDPR Regulation. The referring court refers to Article 2(1) of the Regulation 
(material scope) as well as to Article 4. point (1). (the concept of personal data), 
Article 4. point (2). (the concept of processing), Article 4, point (15), (the concept 
of data concerning health), and Article 9(1) (the prohibition on processing of 
personal data).  
Digital Certificates Regulation. The referring court refers to Article 1 of the 
Regulation (Subject Matter) and Article 10(1) to (3) (personal data, processing, 
and scope of the GDPR).  
Provisions of national law relied on 
The Pandemic Law. 5 Pursuant to Paragraph 2(1), the defendant may introduce an 
extraordinary measure ordering, prohibiting, or restricting certain activities or 
services in order to prevent the spread of the COVID-19 virus.  
 
3 Certificates issued pursuant to Regulation (EU) 2021/953 of the European Parliament and of the 
Council of 14 June 2021 on a framework for the issuance, verification and acceptance of 
interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID 
Certificate) to facilitate free movement during the COVID-19 pandemic (‘the Digital 
Certificates Regulation’). 
4 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on 
the protection of natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC (‘the GDPR Regulation’). 
5 Zákon č. 94/2021 Sb., o mimořádných opatřeních při epidemii onemocnění COVID-19 a o 
změně některých souvisejících zákonů (Law 94/2021 on extraordinary measures during the 
COVID-19 pandemic and amending certain related laws), version effective as of 14 January 
2022 (the ‘Pandemic Law’). 
MINISTERSTVO ZDRAVOTNICTVÍ 
 
3 
Anonymised version 
Succinct presentation of the facts of the case and arguments of the parties to 
the proceedings  
1 By an extraordinary measure effective as of 3 January 2022, the defendant 
mandated compliance with the condition of infection-free status for the entry of 
persons into certain indoor and outdoor premises or for participation in mass-
organised events or other activities. In order to show whether customers (viewers, 
participants) comply with the conditions, the defendant stipulated that operators of 
facilities, service providers, and event organisers were obliged to conduct checks 
using the defendant’s mobile application ‘čTečka’, to reliably verify the veracity 
and validity of a certificate containing a QR code.  
2 On 20 January 2022, the applicant applied for the annulment of the extraordinary 
measure, arguing that the measure unduly interferes with his personal rights, in 
particular the right to privacy, by combining the obligation to check and the 
obligation to document compliance with the infection-free status conditions. The 
defendant did not justify the obligation to use the ‘čTečka’ application and failed 
to make a statement with respect to the issue of personal data protection 6 or with 
respect to the legitimate handling of that data. In transferring the obligation to 
operators and customers, it failed to lay down rules for the processing of special 
categories of personal data, as defined by the GDPR Regulation, including the 
scope of the rights and obligation of the said persons. According to the applicant, 
the checking on the infection-free status conditions amounts to, at least in part, 
automated processing of personal data, as defined in Article 2(1) of the GDPR 
Regulation.  
3 According to the defendant, there is no such interference with the applicant’s 
rights, as the applicant is able to document his infection-free status by a certificate 
in either electronic or physical form. The defendant referred to the judgement of 
the referring court of 28 January 2022, ref no. 8 Ao 29/2021-98, 4312/2022, 
according to which the mere visual inspection of a certificate does not fall within 
the material scope of the GDPR, as no automated processing of personal data is 
taking place, and in the case of non-automated processing, no record thereof is 
kept.  
4 At the request of the referring court, the defendant stated that the ‘čTečka’ 
application is used for checking on and verifying the validity of certificates issued 
pursuant to the Digital Certificates Regulation. Upon the installation of the 
application, the information appears that the application processes the personal 
data of the holders of such certificate for the purpose of being checked by 
authorised persons.  
 
6 Meaning the data displayed in a mobile application after a QR code is scanned: name, surname, 
date of birth and nationality, information about having undergone vaccination, including the 
date and type of vaccine used, or of having recovered from the illness or having undergone a 
PCR test.  
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-659/22 
 
4  
Anonymised Version 
5 Specifically, the application scans the QR code of the certificate using a mobile 
telephone camera. It then displays, for the person conducting the check, a preview 
of the certificate holder’s basic data (name, surname, and date of birth), and the 
status valid/invalid. When scanning the QR code, the application verifies the 
certificate’s public key and the validity of the certificate vis-à-vis currently 
applicable validation rules (the application downloads, once every 24 hours or 
upon request, public keys of Member States’ certificates and the Member States’ 
validation rules from the defendant’s interface). This process may run off-line as 
well. Upon request (clicking a button), the application displays the complete set of 
the information shown in the certificate (e.g., vaccination, type of vaccine, vaccine 
manufacturer, number of doses, date of vaccination, date of first positive result, 
the EU Member State, the certificate issuer, and the certificate identifier). The 
application does not retain that information or send it anywhere. It only 
temporarily displays it on the screen of a mobile telephone.  
Analysis of the question referred 
6 In the view of the referring court, there is no doubt that the data contained in the 
certificates constitutes personal data as defined in Article 4, point (1), of the 
GDPR Regulation. The Czech Republic issues certificates with a QR code in line 
with the Commission’s decision implementing the Digital Certificates Regulation.  
7 The question arises as to whether ‘processing’ as defined by the GDPR Regulation 
should be interpreted so broadly as to include the scanning of a QR code and the 
displaying of information, i.e., an operation involving personal data during which 
the data is adapted to a form readable by a human and is made available on a 
mobile telephone. This adaptation takes place using an automated procedure, i.e., 
an application. De facto, it is a mere computing operation in which personal data 
is in no way handled and there is no risk of any misuse of the data. It is a mere 
translation of information from a machine-readable form to a form readable by a 
human, and its display on a mobile telephone. In that case, any operation 
conducted by an electronic device where any code is scanned and displayed in an 
electronic device, even though it is not used any further (e.g., the scanning of a 
QR code from business cards, the scanning of data in the machine-readable 
section of an identification card, passport, or visa) could be deemed to constitute 
processing.  
8 If the operation described in the previous paragraph does not amount to 
processing, the question arises as to whether personal data is processed when the 
person conducting the check views the personal data displayed in a mobile 
telephone using the application. There is no question that the mere visual 
consultation of a certificate, whether on paper or in electronic form, does not fall 
within the material scope of the GDPR Regulation, as no automated processing of 
personal data is taking place, and in the case of non-automated processing, the 
condition of keeping a record is not met; however, it is not certain whether 
automated processing of personal data subsequently takes place when the person 
MINISTERSTVO ZDRAVOTNICTVÍ 
 
5 
Anonymised version 
conducting the check consults the data through the ‘čTečka’ application, 
following the scanning of a QR code. In the view of the referring court, the mere 
consultation of personal data obtained by a person from a QR code with the use of 
an application (i.e., the translation of machine data into a form readable by a 
human) cannot be deemed to constitute personal data processing, provided that the 
data is processed no further (e.g., saved or sent anywhere). From this point of 
view, this does not differ from a paper certificate. 
9 Furthermore, the verification of the validity of a certificate using the ‘čTečka’ 
application could amount to personal data processing, as personal data about a 
person’s state of health, i.e., for example, the date of vaccination, the number of 
doses, the type of vaccine, is being compared with applicable validation rules that 
the application regularly downloads. That data is not used for any purpose other 
than that comparison and the validation rules will apply even if certificates are 
checked only visually. Furthermore, these rules are not linked to a specific person, 
but rather, to data concerning an infection-free status.  
10 If the case described in the previous paragraph does not amount to processing 
either, it is to be asked whether the combination of all of the above-stated 
processes that take place during the checking of certificates using the ‘čTečka’ 
application amounts to processing, meaning (i) the conversion of personal data 
from a QR code to a form readable by a human and its projection in a mobile 
telephone; (ii) the consultation of the data by the person conducting the check; and 
(iii) the assessment of the validity of a certificate by the application, by comparing 
the personal data concerning the state of health with validation rules.  
11 The referring court leans towards the interpretation that, in aggregate, it amounts 
to personal data processing. This conclusion is also supported by Article 10(1) to 
(3) of the Digital Certificates Regulation. Even though the Czech Republic uses 
certificates issued pursuant to the Regulation in relation to the extraordinary 
measure issued for national purposes (checking on compliance with the condition 
of an infection-free status), it would be appropriate for the handling of personal 
data in certificates to be regulated by a uniform legal regime, as is the case with 
cross-border transport. This rationale is also based on recital 48 of the Digital 
Certificates Regulation.  
12 According to the referring court, in its judgment of 27 April 2022, in Roos and 
Others v Parliament (T-710/21, T-722/21 a T-723/21, EU:T:2022:262), the Court 
considered the checking of certificates by authorised personnel of the European 
Parliament using the national applications ‘CovidScanBe’ and ‘Covidcheck.lu’ 7 
to amount to the processing of personal data as defined by Article 3, point (3), of 
Regulation 2018/1725, 8 which defines personal data processing in the same way 
 
7 These applications operate on a principle similar to that of ‘čTečka’.  
8 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 
on the protection of natural persons with regard to the processing of personal data by the Union 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-659/22 
 
6  
Anonymised Version 
as Article 4, point (2), of the GDPR Regulation. The Court based its judgment on 
a document 9 of the European Data Protection Supervisor, in which he concluded 
that the digital verification of certificates that involves the scanning of a QR code 
constitutes personal data processing, as defined by Article 3, point (3), of 
Regulation 2018/1725. 
13 Nevertheless, the question referred has not yet been addressed by the case-law of 
the Court of Justice, and it is not possible to infer from the Court’s case-law how 
broadly the term ‘personal data processing’ pursuant to Article 4, point (2), of the 
GDPR Regulation is to be interpreted.  
      
institutions, bodies, offices and agencies and on the free movement of such data, and repealing 
Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘Regulation 2018/1725’).  
9 Return to the Workplace and EUIs’ screening of COVID immunity or infection status | 
European Data Protection Supervisor (europa.eu)