Imagine you have a sixteen-year-old son or daughter with an impeccable academic record. You decide to join a project promoted by the school to offer him or her a year of study abroad, a unique educational opportunity. Now let's add a detail: your son or daughter is particularly talented in a sport, so much so that he or she deserves a scholarship. Everything seems perfect, until you discover that he or she can participate in the program only if fully vaccinated.

Such situations are far from rare. We receive monthly reports from families who are faced with a little-known reality: the organizations that manage student mobility programs, i.e. school exchanges abroad, require participation to be subject to the administration of numerous vaccines, including any boosters. The forms required by some of these organizations specify the need to know whether the following vaccinations have been administered:

1. Measles
2. Mumps
3. Rubella
4. varicella
5. Hepatitis B
6. Hepatitis A
7. Diphtheria
8. Tetanus
9. Pertussis
10. Polio
11. Tuberculosis
12. Meningitis
13. COVID-19

Thirteen vaccinations with related boosters to be filled out at the time of enrollment using a form, under the careful advice of volunteer staff: this is the process of one of the various organizations that deals with student mobility and we are not talking about a small, unknown association, but about Intercultura ODV,(1) one of the main Italian organizations active in student mobility since 1955 and recommended by many Italian schools. 

Intercultura writes clearly that its projects are attended by those who have been vaccinated, in fact it is written on their website⁽²⁾ that for “in almost all destinations, participation is tied to the presence of medical vaccines, necessary based on government, school and local cultural indications”. 

However, we ask you: is it really mandatory for your child, who dreams of a study experience in Spain or another European country, to undergo 13 vaccinations to comply with the indications of "local culture"? In our opinion, no.

Regulatory aspects

The Ministry of Education, in accordance with Art. 192 of Legislative Decree no. 297 of 19 May 1994,(3) and in particular with the MIUR note 843/10 April 2013 “Guidelines for Individual International Student Mobility”, supports and regulates the school year abroad by planning it according to the school career achieved on the national territory.

From a careful analysis of the main organizations that deal with student mobility, we can tell you that on an average of 50 countries proposed as student exchange destinations, more than half are in Europe or the United States and nowhere in the Italian legislation or in any of the individual European states(4) is there a vaccination obligation or a requirement to communicate one's vaccination status in order to complete one's studies. 

Even for African or Asian destinations, any vaccination requirements (e.g. yellow fever) are often absent from the proposed forms. Instead of collecting detailed data on the vaccination status of candidates, it would be enough to direct families to the official website Safe traveling of the Ministry of Foreign Affairs, where it is possible to easily consult any specific vaccination requirements for each destination. It is therefore not clear why personal health data that are not necessary for the purposes of the project are requested.

The Big Problem of Privacy

As of May 25, 2018, EU Regulation no. 2016/679 (GDPR)(6) came into force in all European Union countries, regulating the processing of personal data by individuals, companies or organizations. This recent regulatory context has brought some major innovations to the European landscape regarding data management, such as transparency on why they are collected, how they will be used, how they are collected, processed and, above all, on the possible method of disclosure. 

The data of European citizens, precisely by virtue of the GDPR, must have a specific and legitimate reason to be collected by individuals, companies or organizations and can only be used for the designated purpose and must not be processed for any other purpose. The principle of security has become paramount and those who collect your data must ensure that all appropriate measures are in place to protect the data itself, with also an assumption of responsibility by those who manage and collect them regarding compliance with the other principles.

The regulation concerns all types of data collected, but outlines particular attention towards those “relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information relating to his or her health status”. This type of data, regulated by Art. 4 of the GDPR, is included in the broader category of data subject to special processing (Art. 9 of the GDPR), as it is capable of revealing very intimate details of the person and for this reason there is enhanced protection. Such data enjoy guarantee measures that provide that they can be processed “by or under the responsibility of a professional subject to the obligation of professional secrecy in accordance with Union or Member State law or rules established by the competent national bodies or by another person also subject to the obligation of secrecy in accordance with Union or Member State law or rules established by the competent national bodies” (Art. 9 of the GDPR).
Another key principle of the GDPR concerns minimization: data controllers cannot collect more data than is actually necessary for the purpose of the processing itself and that this data must be kept only for the time necessary to achieve that purpose (Art. 5 of the GDPR).

Nowhere in the current European legislation is there any mention of the possibility that health data can be collected by anyone, much less transferred to third parties for unspecified purposes.
But not only that, always from the website and from the Intercultura forms that are proposed and requested from each family, we read that “Medical conditions will be assessed by expert personnel in Italy, but the final decision on accepting the application will be taken by Intercultura's partner organization abroad, based on the real possibilities of finding a host family” and this would appear to reveal a transfer of minors' health data to third parties.

Conclusion

Participation in student mobility projects should never be subject to pressure or limitations related to vaccination status, which remains a private matter and the exclusive responsibility of families and doctors. No organization, in the absence of specific regulations, can request such information or limit individual freedoms based on it and even in the presence of specific regulations – a remote hypothesis for the planned destinations – the collection and processing of personal data must comply with the strict rules of the GDPR. Requests that do not comply with these regulations are arbitrary and illegitimate.

We will contact the organizations concerned to obtain clarifications and, where situations emerge that we deem irregular, we will report the violations to the Privacy Guarantor. Subsequently, we will make available a dedicated form to protect the privacy of you and your children.

Corvelva Staff