EU data authorities issue joint opinion on Covid-19 passes

The European Commission’s proposed ‘digital green certificate’ would allow people who have had a Covid-19 vaccine, or have recently tested negative for the virus, to travel within the EU.

In a statement, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) said: “The data protection commissioners from all EU and European Economic Area countries highlight the need to mitigate the risks to fundamental rights of EU citizens and residents that may result from issuing the digital green certificate, including its possible unintended secondary uses.

“The use of the digital green certificate may not, in any way, result in direct or indirect discrimination of individuals, and must be fully in line with the fundamental principles of necessity, proportionality and effectiveness.”

A joint opinion issued by the EDPB and EDPS states that a distinction should be made between a vaccination certificate and the term ‘immunity certificate’, pointing to a lack of scientific evidence to support the fact being vaccinated or having recovered from the virus grants immunity.

The two authorities recommended that a ‘comprehensive’ legal framework and appropriate legal basis in the member states should accompany the launch of the certification.

Andrea Jelinek, chair of the EDPB, said: “Any measure adopted at national or EU level that involves processing of personal data must respect the general principles of effectiveness, necessity and proportionality.”

Wojciech Wiewiórowski, EDPS, said: “It must be made clear that the proposal does not allow for – and must not lead to – the creation of any sort of central database of personal data at EU level. In addition, it must be ensured that personal data is not processed any longer than what is strictly necessary and that access to and use of this data is not permitted once the pandemic has ended.”

In the UK, the government is planning to trial Covid-19 status certificates, colloquially known as ‘vaccine passports’, at large sporting and leisure events. The trials will first involve Covid-19 testing and will later introduce vaccine certification.

The proposal has been criticised by a number of politicians including Conservative back-benchers.

Information commissioner Elizabeth Denham said: “The success of any Covid-status schemes will rely on people trusting them and having confidence in how their personal data will be used. It is crucial that, from the start, thought is given to how data can be used fairly and how this can be explained clearly to people using a scheme.”

Any organisation processing personal data as part of a certification scheme would be responsible for complying with data protection law.

Denham added: “My office has been briefed regarding the government’s ongoing work regarding Covid-status certification, and I welcome commitments we have received to continue open engagement that will enable us to advise on protecting people’s personal data during development of a scheme.”