Why simply viewing client data on a mobile app isn’t a transfer under the GDPR

I’m seeing significant misinterpretations of the CJEU’s newest GDPR judgment. The CJEU *did not say* today that simply seeing information on a mobile app is processing of personal data. Instead, it said that *the process by which a COVID certificate is scanned by a device and then interpreted to reveal a green checkmark or a red cross* involves automated means and is processing.

Basically, looking at an app on someone else’s phone doesn’t automatically mean that you are processing personal data that may be presented on that phone’s screen. You need to be doing something through automated means with that information – for instance, getting an app on your own phone to scan and analyse it. [Or through non-automated means, but then there has to be some kind of filing system involved]

In practice, viewing personal data on *another person’s* device is not the same as viewing personal data on *your* device – and additional requirements apply if you’re just looking on someone else’s device.

Relevant excerpts (machine translation, no English version available as of the time of this writing):

“29 In the present case, a national mobile application, such as the “?Te?ka” application, scans the QR code on the EU digital COVID certificate in order to convert the personal data contained in that code into a format readable by the person responsible for checking the validity of that certificate. In so doing, such an application enables the person responsible for carrying out the check to consult, following an automated process, i.e. scanning, personal data and to use it to assess whether the situation of the person concerned complies with the validation rules, i.e. the applicable health requirements. The result of this assessment is also automated, since a green tick appears on the inspector’s mobile phone when the health requirements are met, while a red cross appears when they are not.

30 It should therefore be considered that the verification, by means of the “?Te?ka” application, of the validity of interoperable COVID-19 vaccination, test and recovery certificates issued under Regulation 2021/953 constitutes “processing”, within the meaning of Article 4(2) of the GDPR and falls, in accordance with Article 2(1) of that Regulation, within the material scope of the latter.

Judgment (C-659/22, currently only in French and Czech):
https://lnkd.in/eskwrqaG

privacy data protection