Print

Smart Vaccination Certificate

As COVID-19 vaccination programmes proceed in many countries, governments worldwide are moving towards issuing so-called smart vaccination certificates (SVCs) which are interoperable and that document the vaccination status of their bearers. Governments facilitate the re-opening of their economies by easing some restrictions for the free movement and travelling of individuals who have been vaccinated against SARS-CoV-2 and can demonstrate it with a vaccination certificate. 

The European Union adopted its Regulation on the so called “EU Digital COVID Certificate” to enable free movement during the pandemic. When travelling across EU Member States, the EU Digital COVID Certificate holder should in principle be exempted from free movement restrictions: Member States should refrain from imposing additional travel restrictions on the holders of an EU Digital COVID Certificate, unless they are necessary and proportionate to safeguard public health. 

Currently, many European countries such as France, Greece and Italy have already or are adopting SVCs to enter all indoor hospitality venues as cafés, restaurants, workplaces and a range of other venues in order to prove vaccination or immunity. This measure revealed necessary after the spread of new variants across the EU.

SVCs use machine readable images as barcodes with digital signatures and have been considered early on in the pandemic for their higher security against forgery and higher convenience both for the carrier and for the verifier. The WHO tasked in early 2021 a global working group of experts to provide recommendations for secure and interoperable SVCs. These recommendations also looked at situations with no printer, internet or smartphone. In May 2021 the scope and direction of the working group has been updated by WHO and refers in its recommendations now to Digital Documentation of COVID-19 Certificates (DDCC) that like the EU’s DGC also encompass certificates on test and recovery status. The EU’s use of interoperable SVCs provide for a sunset clause to retire the SVCs, but some experts expect that societies will rely on it also to fight future pandemics.

Amongst other countries, Israel is issuing COVID-19 certificates to Israeli citizens, and private businesses are already relying on those to grant access to private spaces e.g. restaurants, shopping malls, events. The USA are now also considering federal certificates or passports for travel and other purposes such as authorising to enter specific public and private places.

 

Positive foreseen impacts on data protection:

  • Easier and more secure access to personal data concerning health: certificate bearers have easier access to their own health data. Because of the verification of digital signatures, their health data offers a high degree of integrity and is as such more trustworthy. SVCs are convenient, because they may be verified partially or entirely automatically. 
  • Improved interoperability based on trust: the interoperability design scheme of SVCs may enable the bearer to verify its health status with security across borders. For this interoperability between countries, authorities exchange cryptographic country keys as is already the case for the verification of electronic passports. Such a system relies on reciprocal trust amongst countries and the capacity of each country to accurately issue and manage COVID-19 vaccine certificate and the personal data include therein. 

 

Negative foreseen impacts on data protection:

  • High risk of repurposing bearers’ personal data: SVCs must contain personal data allowing verifiers to link the health data to the carrier. However, this data may be repurposed to use SVCs as identity documents, enabling tracking of bearers. This opens doors to discrimination or infringement of the fundamental rights and freedoms of the bearers. For instance, event organisers or shops could recognise first-time and frequent guests and treat them differently.  
  • Several risks from the software solution: depending on the deployment of the software for bearers to manage and display their certificates, bearers may be nudged to use certain software solution that do not fully comply with data protection rules. If health data is stored on blockchains, risks for individual rights such as the right to correction or deletion may emerge. The potential centralisation of health data in backend IT infrastructure increases incentives of malicious actors to obtain the data. 

 

Further readings:

 

TechChampions: Dina Kampouraki; Robert Riemann