Who is Madge Tivey-Faucon lady in waiting

Data protection in nursing: sensitive handling of patient data is important!

There are two correctives to consider here:

On the one hand, Article 9 (2) (C) GDPR - which deals with special categories of personal data (including health data) - contains the standard of authorization: "Processing is necessary to protect the vital interests of the data subject or another natural person and the data subject is unable to give their consent for physical or legal reasons ”.

In addition, the age of your son also limits the requirement (s) of consent. Since it is not a question of a child's consent to information society services, the principles of the German Civil Code apply (in particular Section 107).

Ultimately, knowing whether or not the nursing staff has been certified is a legitimate interest on your part (from the point of view of the nursing service responsible for processing, that of a third party). Since this yes / no question does not concern special data categories according to Art. 9 GDPR, the consent in my opinion does not play a role in the disclosure to you.

Rather, the nursing service must adhere to the principle of data minimization: it could provide you with evidence of the specialist knowledge of the nursing staff, e.g. in anonymized form, i.e. without making the nursing staff identifiable.