The European Parliament and the Council of Ministers of the EU recently reached an agreement on COVID-19 certificates designed to facilitate travel and help revive tourism in Europe. Although the certificate is expected to greatly simplify travel within the EU, its large-scale deployment is not without scientific, legal, and ethical challenges. The current analysis sheds light on the main tenets of the agreed EU framework and highlights the positions and initiatives of the main stakeholders. It also examines the major ethical and legal questions associated with the release of the certificate and makes a series of recommendations that could contribute to the efficient handling of some of these challenges so as to ensure a socially-responsible and effective use of this new EU instrument.
You may read here in pdf the Policy Brief by Mihalis Kritikos, Researcher, ELIAMEP; AI Governance Fellow at the Brussels School of Governance – Vrije Universiteit Brussel.
Introduction
Since the authorization and initial release of the first vaccines, the question of whether vaccination against Covid-19 should or even must lead to special rules for vaccinated people has become the subject of controversial public discussion both at the EU and at the global levels. These rules have recently taken the form of digital vaccination certificates that allow people to travel freely and safely across Europe.
The idea of vaccination passports is actually an old one. The vaccine verification debate goes back to the 1890s, during the third global plague pandemic. There is a long history of the use of vaccine certifications for international travel, with many countries currently requiring travelers to present proof of yellow fever vaccination to enter, for example. Vaccine certification checks came under the International Sanitary Regulations adopted in 1951 by WHO member states (and replaced by and renamed the International Health Regulations in 1969).
Currently, yellow fever is the only disease specified in the International Health Regulations for which countries may require proof of vaccination as a condition of entry, although many countries set their own requirements for vaccinations. Therefore, the current version of a passport is the World Health Organization-approved yellow card, which since 1969 has been a document for travelers to certain countries to show proof of vaccination for yellow fever to prevent the spread of the disease.
Against this background, the idea of issuing COVID-19 vaccination certificates/vaccine passports/ immunisation certificates for travel purposes has been put forward. It is based on the linking of health status (vaccine status and/or test results) with verification of identity, for the purpose of determining permissions, rights or freedoms (such as access to travel, leisure or work). These certificates are designed to provide a private and secure way of checking who has been vaccinated that includes a verification process.
Several countries have started to implement or are considering the use of the so-called “digital health passports” or “immunity passports,” i.e., a tool to grant access to certain establishments, activities, and events. It is estimated there are currently more than 70 digital health passports and 14 vaccine passport apps in operation globally. Israel began issuing ‘green passes’ in February 2021 to their vaccinated citizens to allow for less restricted internal movement and access to businesses such as to gyms or theaters. Other countries, such as China, Bahrain, Georgia and 16 E.U. countries are using EU’s digital certificate are issuing digital vaccine passports to their vaccinated citizens to equip them to travel internationally.
Despite their role in allowing a safe return to more normal life, the deployment and implementation of digital health passes involve considerable scientific, technical, ethical and legal challenges that require immediate policy attention and comprehensive and citizen-friendly solutions.
The EU Legal Framework
“The certificate aims at facilitating safe and free movement during the COVID-19 pandemic by providing proof that a person has either been vaccinated against COVID-19, received a negative test result or recovered from COVID-19.”
At the EU level, after a long series of negotiations, the Council of the European Union and the European Parliament recently came to an agreement on the EU digital COVID certificate. The certificate aims at facilitating safe and free movement during the COVID-19 pandemic by providing proof that a person has either been vaccinated against COVID-19, received a negative test result or recovered from COVID-19. In practice, these will be three distinct certificates.
The legal framework in the form of Regulation (EU) 2021/953 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic will enter into force on the 1st July 2021. The certificate will be available in digital and paper format, will contain a QR code and be issued free of charge. Therefore, those vaccinated will be provided with certificates that contain COVID-19 vaccination details and health facility. The certificate will not be a precondition to exercise the right to free movement and will not be considered a travel document.
“However, it remains up to national governments to decide whether travellers with a certificate have to quarantine or get tested.”
According to the agreed rules, Member states should refrain from imposing additional travel restrictions, such as testing or quarantine, unless they are proportionate and necessary to safeguard public health. If they decide to introduce travel restrictions, member states must inform the other member states and the Commission, if possible 48 hours in advance. They must clarify the reasons for such restrictions, their scope and the start date and duration. This information should be published 24 hours before the measures come into effect. However, it remains up to national governments to decide whether travellers with a certificate have to quarantine or get tested.
“The legislation gives member states the option to accept vaccination certificates issued for vaccines which have been authorised nationally or have completed the WHO (World Health Organisation) emergency listing process.”
When a person presents a vaccination certificate for one of the vaccines approved by the European Medicines Agency (EMA), member states will be obliged to accept it for the purpose of facilitating freedom of movement. The legislation gives member states the option to accept vaccination certificates issued for vaccines which have been authorised nationally or have completed the WHO (World Health Organisation) emergency listing process. It needs to be stated that the European Commission is currently in the process of establishing a common digital infrastructure to allow the authentication of those certificates, while Member States should develop interoperable technical solutions at national level to issue and process such certificates.
Legal and socio-ethical challenges
“…scientific knowledge in this field includes several critical unknowns about the risks mitigated by vaccination, whether vaccinations rule out the potential for transmission, the duration and type of immunity of vaccinated and recovered persons, and the extent of protection conferred by vaccination, particularly against new variants.”
While the certificate is presented as a solution to the impasse on free movement generated by the pandemic, the scientific, ethical, legal and policy issues related to the design, use, and ethics of vaccine passports that may affect their adoption, acceptance and usage merits closer attention.
- First of all, scientific knowledge in this field includes several critical unknowns about the risks mitigated by vaccination, whether vaccinations rule out the potential for transmission, the duration and type of immunity of vaccinated and recovered persons, and the extent of protection conferred by vaccination, particularly against new variants. In other words, given that the architecture of these vaccines is built on evolving science, any novel scientific findings and opinions that may diverge or depart from the current knowledge base may question or undermine the scientific basis of the process.
The WHO has stated there is a need for further scientific investigation into COVID-19 vaccine products to understand in more detail each vaccine product’s unique immunity profile, the extent vaccines reduce transmission, and the strength and duration of immunity provided. COVID-19 passports may need to consider when issuing certification of vaccine-induced immunity over a certain period of time, a process which becomes even more complicated in the presence of variants with unknown effects on vaccine effectiveness.
- From a technical perspective, there are currently no clear international rules and policies guiding the use of electronic vaccination certificates amid COVID-19. Thus, the release and use of COVID-19 electronic vaccination certificates may encounter several impediments such as heterogeneous communication protocols, standardization and interoperability issues with other apps, privacy and security issues.
Moreover, given that traditional vaccination cards can be forged and faked via easily accessible technological means, the risk posed by false COVID-19 certificates is real. On 1 February 2021, Europol issued an Early Warning Notification on the illicit sales of false negative COVID-19 test certificates.
“…the introduction of the EU COVID-19 Certificate will manage to set the ground for uniform requirements and restrictions that Member States could introduce and implement such as quarantine, self-isolation or a test for SARS-CoV-2 infection.”
Related to the issue of the lack of international agreements is that of digital standards. Currently, there is no standardized guidance related to the design of COVID-19 vaccine passports, including any standards for issues such as data privacy or interoperability. The WHO’s Smart Vaccination Certificate Working Group released its first round of guidance addressing key specifications, standards and a trust framework for a digital vaccination certificate to facilitate implementation of effective and interoperable digital solutions in March 2021 whereas EU’s e-Health Network has adopted a Trust framework for the interoperability of health certificates.
- From an EU harmonization perspective, there are questions about whether the introduction of the EU COVID-19 Certificate will manage to set the ground for uniform requirements and restrictions that Member States could introduce and implement such as quarantine, self-isolation or a test for SARS-CoV-2 infection. Under the agreed rules, the Member States are allowed to accept or not antigen tests, the age from which the certificate is required, the different periods of validity for PCR tests or even the timeframe required after the completion of the vaccination.
“…the travel eligibility and the vaccination status of those EU/non-EU citizens that have been vaccinated with vaccines that have not yet been approved by the European Medicines Agency (EMA).”
Given also, that the EU certificate is based only on vaccines that have been approved at the EU level, there are questions about the travel eligibility and the vaccination status of those EU/non-EU citizens that have been vaccinated with vaccines that have not yet been approved by the European Medicines Agency (EMA) such as Sputnik V, Sinopharm, Covishield and Convidecia. Could possible bilateral agreements between EU and non-EU member states be reached that depart from the agreed EU-wide certification procedure? Last but not least, the EU would need to establish agreements with non-EU countries in order to have these passports recognized for international travel.
- The introduction of vaccine and any digital health passports raises data protection, privacy and security questions as vaccine passports use sensitive personal information that is potentially vulnerable to attackers, especially if such data is stored on a central database at the level of each member state.
The development of use of these certificates may need to be considered as data processing on a large scale so any unauthorised access to this data could lead to a new form of health surveillance. Another major concern is the possibility that those that have access to these databases such as transport service operators and authorities, may reuse it for purposes other than those initially planned for.
Therefore, the use of this certificate should adhere to the principles of effectiveness, necessity and proportionality and the entities that will be entrusted with the task of controlling and processing of the data at the level of the member states should be specified. Any data retention/processing should be prohibited or exceptionally allowed on the basis of a data protection impact assessment. Such an assessment would be necessary to identify security and privacy risks, and specify the type of safeguards needed.
“…there must be clearly defined parameters such as purpose limitation and data minimization that would reduce the data protection risk.”
Therefore, there must be clearly defined parameters such as purpose limitation and data minimization that would reduce the data protection risk that will emerge once Member States start considering the extension of the application of the Digital Green Certificate for other purposes.
- The release of the certificate also raises a multiplicity of legal and ethical questions that touch upon the protection of human rights (distinction between individuals based on health status) that may affect social cohesion and solidarity. The use of these passports could create a risk of discrimination, social division and could potentially be used to determine the degree of freedom or rights of individuals. Though vaccine passports may offer a return to normalcy, they may also exacerbate existing inequalities as the conditions of accessing this certificate vary from one country to another as each country enjoys exclusive competences in determining who gets the vaccine, who gets the test and who is going to be declared as immunized.
“Without the appropriate guarantees, the certificates may lead to a two-tier society with the vaccinated enjoying their full set of rights, while the non-vaccinated may be faced with social stigmatization, especially in work environments.”
Therefore, the equity issues are both domestic in terms of racialized minorities and rural populations, people who are unable to have vaccines for medical reasons or certain ethnic minorities that are more vaccine hesitant, but also international in terms of access to vaccines for low and middle income countries or in terms of being vaccinated with non-EU approved vaccines. Without the appropriate guarantees, the certificates may lead to a two-tier society with the vaccinated enjoying their full set of rights, while the non-vaccinated may be faced with social stigmatization, especially in work environments.
- Beyond meeting the specific needs of an immunity passport system, there is a high risk that these certificates will develop a permanent use that goes far beyond specific travel needs. The mission and function creep potential of this certificate threatens to transform this new technological instrument into a default digital identity for people without the necessary checks and balances. That would practically mean that the certificates are used for other purposes other those initially claimed, such as in the employment context or in other domains. Therefore, particular policy attention needs to be put to the use of these immunity passports for broader, non-medical purposes such as to permit individuals access to certain businesses, locations or activities.
Positions of the main stakeholders
The World Health Organisation (WHO) has explicitly warned against the use of these certificates for international travel owing to limited information about the impact of vaccines on transmission and limited supply of vaccine and raised concerns surrounding the operational, ethical and diplomatic consequences of allowing certain individuals to avail of privileges that others face hurdles to access. The Ada Lovelace Institute published a lengthy set of checkpoints that it recommends governments and developers should meet as passports move forward.
Moreover, the European Data Protection Board and the European Data Protection Supervisor published a joint Opinion on the Certificate that recommends prohibiting access to the data by Member States following the end of the pandemic and stresses the need for governments to adhere to the principles of “effectiveness, necessity and proportionality” and include “strong and specific safeguards” – to be implemented following an impact assessment. In a statement on human rights considerations relevant to a “vaccine pass” and similar documents, the Council of Europe Committee on Bioethics is calling for careful deliberation on the challenges raised by such a pass and on the steps taken to ensure that the human rights and fundamental freedoms of all individuals are promoted and protected.
A group of public interest groups has also highlighted the lack of safeguards against surveillance by the issuing authority (online verification) and the need for an offline verification via a public key infrastructure that adheres to the principles of privacy by design. When a certificate is verified, the issuer shall not obtain knowledge about the verification process or its circumstances. Last but not least, the European Data Protection Board in cooperation with the European Data Protection Supervisor issued a Joint Opinion 04/2021 on the Commission’s legislative proposal highlighting the need for the EU legislator to better define the purpose of the Green Digital Certificate and provide for a mechanism for the monitoring of the use of the certificate by Member States.
Last but not least, multiple international organizations have already launched efforts to set standards and coordinate the design and implementation of vaccine passports for international travel, including the World Health Organization –as part of its mandate under the International Health Regulations (IHR), World Economic Forum, International Chamber of Commerce, and the International Air Travel Association.
Policy recommendations
As many countries speed up vaccinations and governments around the world are trying to find ways to restore some level of normalcy, the demand for vaccine passports for both international and domestic use will increase over time. The security, authenticity, privacy-preserving, integrity and validity of these certificates and their use only for travel purposes will determine their acceptance at the societal level.
It is therefore necessary to establish a trust framework laying out the rules on and infrastructure for the reliable and secure issuance and verification of certificates. The required infrastructure should be able to function on different major operating systems while ensuring that is protected from cybersecurity threats whilst Member states must implement robust safeguards in line with EU data protection rules.
“The trust framework shall be based on privacy-by-design principles –including strict data retention periods- to ensure robust respect for human rights.”
At the same time, there is a need to make sure that the personal data contained in the certificates is processed only for the purpose of verifying the information included in the certificate in order to facilitate the exercise of the right of free movement within the Union. For this purpose, the personal data shall be limited to what is strictly necessary, hence the data controllers and processors shall take adequate technical and organisational measures to ensure a level of security appropriate to the risk of the processing. The trust framework shall be based on privacy-by-design principles –including strict data retention periods- to ensure robust respect for human rights.
“Any vaccine passport system would need to be dynamic, taking into account the differing efficacy of each vaccine, known differences in efficacy against circulating variants, and the change in efficacy over time.”
Given that the scientific evidence on COVID-19 vaccination, testing and recovery continues to evolve, also in view of new variants of concern of the virus and in the case of newly emerging scientific evidence, there is a need for safeguards that will ensure that the scientific basis of the systems remains sound and up-to-date. Any vaccine passport system would need to be dynamic, taking into account the differing efficacy of each vaccine, known differences in efficacy against circulating variants, and the change in efficacy over time. Therefore, those involved in the implementation of this certification scheme need to have ready access to the best and most up-to-date scientific information on vaccine effectiveness especially in relation to new variants and the limitations of the various vaccines.
Moreover, digital vaccine certificates should never become an actual or de facto requirement for exercising fundamental rights and governments must refrain from using COVID-19 as an excuse to expand mass or targeted surveillance practices. So, policy-makers need to identify some settings (such as essential public services, public transport and essential shops) where COVID-status certification should never be required. Therefore, these passports must align with national and international legal norms upholding principles of fairness, transparency and lawfulness, purpose specification, minimisation (necessity and proportionality), accuracy, storage limitation, and confidentiality and integrity. In other words, the immunity passport infrastructure needs to be dismantled once the pandemic is over and clear sunset clauses should be introduced in order to safeguard the temporary character of such passports.
Concluding remarks
The current vaccine passport debate is complex, encompassing a range of different proposed design choices, uses and contexts, as well as posing high-level and generalised trade-offs, which are impossible to quantify given the current scientific evidence base. As the use of the same certification data could grant privileged and exclusive access to rights thus creating risks of discrimination, policy-makers and regulators alike need to make sure that the uses of immunity passports must be clearly articulated and that the certificates pass the test of proportionality and ethical acceptability.
“The release of these certificates as a technological solution should not be seen as a comprehensive approach to the identification of peoples’ health status and the respective shaping of their freedoms.”
The release of these certificates as a technological solution should not be seen as a comprehensive approach to the identification of peoples’ health status and the respective shaping of their freedoms. Instead, they should be seen only as one of out of several public health measures that need to be taken so as to help societies open return to some form of normalcy. Their implementation will require ethical justifications and legal solutions that need to strike the right balance between data privacy, human rights, public health and economic interests. It should also entail the management of the risks associated with the creation of a new distinction between individuals based on their health status which may also going to be used to determine the degree of freedoms and rights individuals may enjoy. Therefore, public authorities should foster a shared and trusted global vaccine certificate that will prevent all possible harms and threats including exclusion, discrimination and profiling by designing it from a public health angle rather than a travel perspective.
Bibliography
Brown, R., Savulescu, J., Williams, B., & Wilkinson, D. (2020). Passport to freedom? Immunity passports for COVID-19. Journal of Medical Ethics, 46(10), 652–659. https://doi.org/10.1136/medethics-2020-106365.
Deguma MC, Deguma JJ. The possible threat of faking Covid-19 diagnostic tests and vaccination certifications: a call to an immediate action. J Public Health 2021. doi: 10.1093/pubmed/fdab054.
Douglas, T. (2021) ‘Cross Post: Vaccine Passports: Four Ethical Objections, and Replies’. Practical Ethics. Available at: http://blog.practicalethics.ox.ac.uk/2021/03/cross-post-vaccine-passports-four-ethical-objections-and-replies/
Ishmaev, G., Dennis, M. & van den Hoven, M.J. Ethics in the COVID-19 pandemic: myths, false dilemmas, and moral overload. Ethics Inf Technol (2021). https://doi.org/10.1007/s10676-020-09568-6
Kofler, N. and Baylis, F. (2020) ‘Ten reasons why immunity passports are a bad idea’, Nature, 581(7809), pp. 379–381. doi: 10.1038/d41586-020-01451-0.
Noble A. No Jab, No Job: Why Your Employer Can’t Sack You for Not Taking the COVID Vaccine in UK. https://theconversation.com/no-jab-no-job-why-your-employer-cant-sack-you-for-not-taking-the-covid-vaccine-in-uk-154403
Pai. M., (2021) ‘How Vaccine Passports Will Worsen Inequities In Global Health,’ Nature Portfolio Microbiology Community. Available at: http://naturemicrobiologycommunity
Phelan A. L. (2020). COVID-19 immunity passports and vaccination certificates: scientific, equitable, and legal challenges. Lancet (London, England), 395(10237), 1595–1598. https://doi.org/10.1016/ S0140-6736(20)31034-5.
Thomas, N. (2021) ‘Vaccine passports: path back to normality or problem in the making?’, Reuters, 5 February 2021. Available at: https://www.reuters.com/article/us-health-coronavirus-britain-vaccine-pa-idUSKBN2A4134
Voo, T. C., Reis, A. A., Thomé, B., Ho, C. W., Tam, C. C., Kelly-Cirino, C., Emanuel, E., Beca, J. P., Littler, K., Smith, M. J., Parker, M., Kass, N., Gobat, N., Lei, R., Upshur, R., Hurst, S., & Munsaka, S. (2021). Immunity certification for COVID-19: ethical considerations. Bulletin of the World Health Organization, 99(2), 155–161. https://doi.org/10.2471/BLT. 20.280701.