PRIVACY & COVID-19

Challenges of Digital Vaccine Passports

Undeniably, digitization has been our saviour during the COVID 19 pandemic. However, major concerns must be addressed before making digital passports our ticket to our pre-COVID lives.

By Srishti Nair

August 9, 2021

Fernando Ron Pedrique

Introduction

As countries like Canada, Brazil, and Germany continue to battle the third wave of COVID-19,it is clear that the global pandemic has not only claimed millions of lives but has also had a sweeping impact on the social, political, economic and legal narrative of the global community. In view of the same, several mechanisms have been  introduced to aid better adjustment to the “new normal”. One such aiding tool that is becoming increasingly popular is the vaccine passport. It aims to certify the vaccination status of an individual and requires the inclusion of details such as date of vaccination and the kind of vaccine that was administered. 

Need For Digital Vaccine Passport

The primary objective of developing a digital passport has largely been to facilitate return to the pre-COVID-19 era without endangering public health. For the past year, countries have been employing different testing requirements to navigate domestic as well as international travel  and the digital vaccine passport is being seen as another means to an end i.e., an  additional instrument to make travel safer. Given the lack of trust and faith in the present system of paper-based vaccine cards owing to the increasing cases of black marketing, fake certificates etc. the development of digital documentation has become important. It will allow the consumers to avail proof of their vaccination status and assist in serving the growing public interest of getting access to their workplace and other public spaces  while ensuring their physical safety.

What Are The Countries Planning?

As countries fight to restore normalcy in the lives of their citizens, an increasing faith and reliance is being placed on digital vaccine passports. Examples include:   

DENMARK:  The Nordic country has launched a vaccine passport named “Coronapas” which is linked to the already existing secure digital ID system called NemID, which grants the citizens of Denmark access to different online platforms, including their health records and test results. Upon completion of vaccine administration for all the high-risk groups, the vaccine will be used as a proof of vaccination status, earlier infection or a recent negative test which will be necessary to gain access to public places like cinemas,restaurants etc. This will also aid in international travel across the 27 member states of the European Union.

EUROPEAN UNION: The EU proposes a “Digital Green Certificate” which will serve as a proof with respect to an individual’s vaccination status. It will contain information such as an individual's vaccination status, test results and whether or not they have tested negative post recovering from COVID-19. It will further be reinforced with a QR code which will allow the free movement of individuals within the member states. The said certificate will be made available to EU citizens and their families, non-EU citizens whose residence is in the EU and visitors.

ISRAEL: Israel has launched the “Green Pass”, a digital vaccine passport which acts as a proof for individuals who have been fully vaccinated or have recovered from Covid-19. The application links individuals to their personal health ministry data and allows access to public spaces. . Furthermore, it also opens up doors to international travel as Israel has entered into agreements  with Greece and Cyprus , allowing Israeli citizens with passes to travel to those two countries.

Ethical And Legal Issues

While proof for immunization is a path that we have walked down before during the yellow fever, what needs to be considered is the difference in the mode of transmission and the resulting amplified likelihood of the virus spreading.Further, while most countries are focused on returning to normalcy, we must not forget that the passport is not an isolated public health measure, rather, it is a part of the growing digital infrastructure which brings with it a range of  ethical and legal issues, some which are highlighted below: 

Discrimination

Unequal access to public places

The suggested use of digital passports is not limited to international travels but is also linked to access to everyday social activities. While from a utilitarian perspective, community welfare will be facilitated better if inoculation is prioritised on the basis of factors such as age, health, social status etc. but it can also have a debilitating impact on the existing inequalities and discrimination. In the words of the UK Equality and Human Rights Commission (EHRC), “COVID certificates/passports could amount to unlawful discrimination, creating a two-tier society of the vaccinated and unvaccinated.”

Given that vaccine passports are turning into a prerequisite for participation in socio-economic public activities, transformation of the same into a license for discrimination is highly likely. For example: The brunt of India’s technology driven vaccination policy which prioritised the 45+ age group and the subsequent unavailability of vaccine had to be borne by the younger age groups as well as the informal workforce in terms of their safety as well as employability.High rates of unemployment will be especially brutal for the socially and economically marginalised communities which will further push towards the edge.

Thus, it is clear that revival of the pre-COVID era founded on digital vaccine passports will not be identical given the higher probability of discrimination to be inflicted upon groups which cannot get inoculated as well as those who should not get inoculated.Consequently, these groups will be left behind and be denied access to basic facilities such as workplaces, parks, supermarkets etc. which will not only prove to be harmful for the excluded individuals but also deepen the existing socio-economic disparities.

Discrimination between countries

While vaccines rollout has been experiencing high success rates in countries like United States of America, the developing and least developed countries continue to struggle to acquire sufficient quantity of vaccines. Moreover, rapid inoculation of the population heavily relies on technological infrastructure such as access to smartphones, reliable internet connection etc. The profound digital divide prevalent across the globe in specific sections of people including the rural population, socially and economically marginalised communities, refugees, the digitally illiterate etc. will cause these individuals to either be left out or be the last to be inoculated thereby, aggravating the existing disparities.

Moving forward, the difference in vaccine administration rates can also lead to indirect discrimination between nations. The starking contrast in factors such as health infrastructure, access to health care facilities and digital infrastructure can impact the inoculation rates in different countries thereby, exposing their citizens to discrimination especially with respect to international travel. This situation will be further worsened by vaccine acceptance rules being set by different countries. For example: Hungary, Slovakia and the Czech Republic plan to use the Sputnik V vaccine, which while is equally effective as its European counterparts has failed to enjoy equal prestige in the European Union and is even unacceptable on the grounds of merely being of non-European origin. Thus, vaccine passports approved on the basis of such vaccines might as well be invalid and non-existential. 

Data Protection

Highly vulnerable to cyberattacks

Since the advent of the COVID 19 pandemic, personal information of individuals including sensitive health data has been placed at the disposal of public and private entities for different purposes. Bringing such extensive data into the public domain is proving to be a goldmine for cybercriminals as evidenced by the data leak of a health laboratory in France in February 2021, where information relating to approximately 500,000 persons was compromised.

Additionally, with travel restrictions being reduced, the number of people travelling and wanting to pass through security without any hassles is also increasing which could possibly have a snowball effect on creation of fraudulent certificates and passports. Thereby, raising the question of how will real time verification of immunity status be ensured? Further, the outdated encryption technology, lack of an open-source code for majority of the application etc. also contribute to increasing the fear and wariness in the community about the safety of their personal data.

Privacy and Transparency

One of the most critical and worrisome steps involved in the development of vaccine passports is the need to create a system collecting and storing extensive data relating to individuals so as to facilitate effective working of the passports. This would involve tying up with the vaccination databases of different states via their medical records leading to mounting dread of the likelihood of privacy violation especially in countries which either have a weak data protection framework or even worse, none at all. In the absence of a proper system of checks and balances, there is nothing holding back the big tech conglomerates such as Microsoft, Oracle etc. leading the development of digital vaccine passports from exploiting the information made available to them for purposes such as product development, marketing, selling it to third-parties, surveillance etc. Furthermore, given that data protection regulations in most of the non-EU countries are inadequate, cross-border sharing of such highly sensitive data could prove to be a nightmare for both the authorities as well as the general public.

Tool for mass surveillance

The development of vaccination passports will require the creation of a technological infrastructure which will categorise (vaccinated and unvaccinated) and track the health data of different individuals.A trove of such data when combined with sensors and digital systems take away any possible territorial restraints thereby, enabling mass surveillance. Digital passports are being viewed as the future of travel however, the nature and volume of information that will be required into developing an efficient passport system raises several red flags including the purposes for which such information will be utilised, whether or not it’s usage will be limited to the pandemic and if in the post pandemic world, it would aid and intensify shadowing of our private lives by public as well as private institutions.

Purpose and Storage Limitation

The present data protection regulations across the globe are known to have followed the footsteps of the European Union’s GDPR thereby, making the basic principles such as storage limitation, purpose limitation amongst others the cornerstones of these rules and regulations. The purpose limitation principle requires that the data must be collected for only specific and legitimate purposes and it’s processing too must be limited to the purpose for which it was consented to be used by the individual. Similarly, the storage principle also requires that the data should only be stored for a time period which is necessary for fulfilling the specific purpose for which it was collected. The volume of information collected and being processed in the development of creating a vaccine passport system is colossal thereby, making it imperative for the passport developers as well as the governing authorities to ensure that function creep is avoided by designing within the passport system a framework that would collect, process and retain data for only essential usages.

Conclusion

It is undeniable that digitization has been our saviour during the COVID 19 pandemic, from relying on e-commerce websites for daily provisions to social media platforms aiding in relief work, technology has been a blessing in disguise for mankind during these dire circumstances. However, we must remember that once a new technology begins to control us, no longer are we the masters. Thus, it is vital that we be diligent and ensure that the new normal with digital vaccine passports does not begin with us being rolled into the road itself.

Given that the development of a digital passport system is evolving into a global phenomenon it is necessary that the countries come together to develop a comprehensive and standard approach with deep data points agreed upon to ensure effective functioning of the system and also unanimously develop a certain scientific standard that each vaccine will have to pass so as to be recognised universally. Further, there is also a need to pay heed to basic epidemiological questions revolving around the efficiency of a vaccine against different strains of the SARS-CoV-2 virus, the duration of effectiveness of inoculations and probability of inoculates individuals being spreaders of the virus.

Additionally, in view of the issues relating to privacy and data protection, the application developers could be mandated to adopt privacy by design by adopting regulations which would enable the collection of the minimum amount of data while allowing the parties to verify the actual inoculation status of different individuals. Different methods that could be adopted for the same could include authentication via digital signatures to prevent fraudulent passports, use encryption in transit, minimisation of storage etc. They can also oversee the use of the data collected and require the app developers to not undertake any kind of activity including using the information for marketing without obtaining explicit and informed consent of the individuals.

Srishti Nair is a fourth-year law student from Symbiosis International (Deemed) University, India. She is interested towards exploring the intersectionality between law and technology especially protection of privacy and digital rights of the community.