Under the implementation of GDPR, or under derived local rules? Because as far as I understand, humans working on a filing cabinet full of paper can be just as much "data processing" under GDPR as a computer reading a database. If the scheduling person knows "Mr X is sick and needs a replacement scheduled", an algorithm in their place can know that too.
It's certainly something where extra care is required though, and it's easy to see how people in charge go with a rather safe than sorry approach, and extending it into ML poses additional questions.
Our national implementation of the GDPR for the public sector prohibits cross-sectoral access to citizen data.
So while our teachers/nurses could legally use ML for planning as they have a legal right to use the data for planning, our digitisation department can’t build/train/support it and neither can a 3rd party supplier.
Since laws are very open to interpretation, at least until they are tested a few times in the courts, you could interpret them different than us. Which I’m guessing is what our neighbouring municipality is doing. They have the advantage of being 10 times bigger than us though, giving them much more influence, so much in fact, that they may end up paving the way for the rest of us.
It's certainly something where extra care is required though, and it's easy to see how people in charge go with a rather safe than sorry approach, and extending it into ML poses additional questions.