Global Approaches to Developing COVID-19 Verification Certificates

Author(s): Jennifer Jones, Christine Coz

Introduction

According to an IPSOS survey, “71 percent of U.S. citizens believe that all international tourists arriving in the country should be required to show proof of receiving a full COVID-19 vaccination.” The government in the United Sates has not stated what will be required of visitors in the coming months, and individual states such as Texas, North Dakota, Florida, Alabama, and New Hampshire have stated that they will not be pursuing a vaccine passport program. Meanwhile, New York state has introduced its “Excelsior Pass” as the first COVID-19 certificate in the US.

In a recent Angus-Reid survey of Canadians, more than three-quarters of those surveyed (76%) said they would support mandatory vaccination proof for travel outside of Canada. The federal government in Canada has indicated that it is exploring a validation and verification process to facilitate travel.

The European Union indicated in March that a digital green certificate, renamed in May to the EU Digital COVID Certificate, will be required to enter member countries.

What Are Vaccine Certificates?

Vaccine certificates can be a digital certificate stored within a smart phone application or a paper certificate. Both formats function to provide a person with a way of proving that they are vaccinated and are safe to travel or be admitted to a specific location. Supporters of this type of verification process justify it based on recent reports that vaccinated citizens pose less risk of becoming infected with and spreading the virus.

The Office of the Privacy Commissioner of Canada (OPC) recently issued a joint statement of the federal, provincial, and territorial privacy commissioners that identified two guiding principles that must be examined prior to the adoption of a vaccine verification process:

Legal authority: There must be a case for establishing a vaccine verification process that has been clearly defined and supported. Public and private sector businesses that request or require individuals to use a vaccine certificate to enter a specific location or receive services must be sure that they have the legal authority to make this demand.
Consent and trust: A broadly enforced vaccine verification process must be supported through the consent of the general populace that this is the right method to pursue to return to regular activities. However, consent alone is not sufficient, and governments must recognize that in some cases they have exclusive control over the services they provide. Further complicating the principle of consent and trust, passive consent has been used pervasively as a method by digital service providers over the past 20 years to track and access personal information about consumers. Broadly, the misuse and erosion of personal data has resulted in a lack of trust in governments to protect citizen’s personal information.

The OPC statement goes on to say that governments and businesses must rely on existing privacy legislation for the authority to move forward with a vaccine certificate verification method. A vaccine certificate implementation plan requires that:

Consent is voluntary and meaningful, based on clear and plain language that describes the specific use of vaccine verification.
The verification of information is necessary and purposeful.
The purpose for verification is reasonable and considered appropriate given the present risks.
Individuals must have a choice and consent must not be required as a condition of service.

It is important to recognize the privacy risks inherent in adopting a vaccine verification program, and it is critical to evaluate the necessity, effectiveness, and proportionality wherever and whenever they will be used:

Necessity: An enforced verification process must be deemed necessary to accomplish a broad public health objective. The program’s implementation must be evidence-based.
Effectiveness: A verification process must be an effective way to accomplish its defined purpose and must continue to be effective throughout its use.
Proportionality: The privacy risks that result from a vaccine certification program must be proportionate to the public health risks they are seeking to mitigate. Importantly, data minimization should be applied so that minimal personal health information is disclosed.

Privacy principles to consider when implementing a vaccine certificate program:

Limiting collection, use, disclosure, retention, and purpose: Collection, use, disclosure, and retention of personal health information must have limits and apply to what is necessary for the purpose of developing a vaccine certificate. Active and persistent tracking or logging of an individual’s activities through a vaccine certificate by any group (e.g. governments, app developers, or any third party) must not be permitted. The development of centralized databases that contain vaccine information nationally or across jurisdictions must be limited to the necessary elements to administer and verify vaccine information. Data collection and use of the personal health information collected through a vaccine credentialing system ought to be limited to what is reasonably required by law.
Transparency: Individuals must be informed about the purpose and scope of a vaccine certificate program, including information about the collection, use, disclosure, retention, and disposal of their personal health information for the purpose of issuing a vaccine certificate.
Accountability: New policies, agreements, and laws must minimize any impact on personal privacy. Individuals must be informed about how to request access to, or correction of, information available through a vaccine certificate. A mechanism must be provided for individuals to make an inquiry or a complaint about the vaccine certificate.
Safeguards: Technical, physical, and administrative protections must be in place that match the sensitivity of the information collected, used, or disclosed through a vaccine certificate. Processes must regularly test, assess, and evaluate the effectiveness of the privacy and security measures adopted.
Independent Oversight: This is critical to establish trust and accountability in the certificate. Privacy commissioners must be consulted throughout the development and implementation of a vaccine certificate. Privacy impact assessments or other robust analyses should be reviewed by privacy commissioners, and plain-language summaries of the assessments should be publicly available.
Time and Scope Limitations: Personal health information collected for the purposes of a vaccine certificate should be destroyed and the certificate should be decommissioned when the pandemic is declared over by public health officials or when the certificate is no longer necessary. Vaccine certificates should only be used to address a person’s COVID-19 status.

World Health Organization Proposal for a “Smart Vaccine Certificate”

The World Health Organization (WHO) has created a proposal for a smart vaccine certificate (SVC) to help countries verify that individuals have been vaccinated: “A vaccination certificate is a medical document that records a vaccination service that an individual has received. Digital vaccination certificates, or cards, refer to digital immunization records that are accessible by the vaccinated person, and serve the same purposes as traditional home-based records: they provide a tool to ensure continuity of care and a proof of vaccination.” The WHO is proposing a trust framework to govern the SVC. The trust framework consists of:

Broadly accepted and adopted technical specifications,
Standardized interoperability, and
Governance mechanisms that are agreed upon by many entities that establish trust among them.

The intention is that member states participating in the WHO trust framework will be able to trust that the medical documents issued by other member states are authentic. This framework would use public key infrastructure (PKI) to establish a secure, cryptographically supported trust framework to validate SVCs. This is the same mechanism used to confirm online credit card transactions. For a trust network to become commonplace, each member state would have to establish and maintain a domestic PKI system supported by a combination of the right people, processes, and technology to ensure that SVCs are verified. The WHO is proposing that it would manage the public key directory, but the WHO is not proposing to store any personal health data within its Public Key Directory. Rather, the WHO Public Key Directory would be a global registry of public keys linked to member states’ own public health authorities. A global directory of public keys would facilitate cross-border verification and validation of SVCs. The WHO would act as a trust broker and ensure that participating member states meet the SVC interoperability requirements. Each member state would release and maintain a copy of the global list of public keys, and these local cached keys would be used to verify SVCs issued by other member states. Additionally, member states may also exchange public keys bilaterally. This framework also supports the use of regional public keys, and the European Union has proposed this model for its member states, called the EU Digital COVID Certificate.

European Union Digital COVID Certificate

In March 2021, the European Commission presented a proposal to develop an EU Digital COVID Certificate to encourage safe and free movement of citizens within the European Union. An EU Digital COVID Certificate would provide member states with proof that an individual had:

Received a COVID-19 vaccine, or
Received a negative COVID-19 test result, or
Recovered from COVID-19.

The certificate would be freely available in digital or paper format. Embedded on the certificate would be a scannable QR code to ensure the authenticity of the certificate. A gateway built by the European Commission would facilitate the implementation and verification across member states of the EU. Member states would remain responsible to decide the relevant public health restrictions that would apply to EU Digital COVID Certificate holders. The proposal also indicates that all people, regardless of vaccination status, would benefit from the EU Digital COVID Certificate. For example, “If a Member State continues to require holders of a [EU Digital COVID Certificate] to quarantine or test, it must notify the Commission and all other Member States and explain the reasons for such measures.”

Only essential vaccine/recovery status information and secure personal data is collected as a part of the EU Digital COVID Certificate. Information such as name, date of birth, date of issuance, and a unique identifier would be a part of the certificate and only used to verify the authenticity and validity of the certificate. The certificate “will be valid in all EU Member States and open for Iceland, Liechtenstein, Norway as well as Switzerland. It should also be issued to non-EU nationals who reside in the EU and to visitors who have the right to travel to other Member States.” Importantly, the commission notes that the EU Digital COVID Certificate is a temporary measure that will be suspended once the WHO declares the international health emergency has ended.

Other Vaccine Verification Initiatives to Facilitate Travel

There is growing support to implement a verification system to facilitate international travel. Globally, China, Israel, Taiwan, and Japan are planning to implement or already have implemented a vaccination certificate system to enable travel. In the United Kingdom, the National Health Service (NHS) has updated its mobile app to allow fully vaccinated people to prove their status when traveling internationally. The International Air Transport Association (IATA), an airline industry group, has developed an IATA Travel Pass, which has gained the support of major airlines including Qantas, Japan Airlines, Emirates, British Airways and Virgin Atlantic. Other airlines are adopting similar measures, and the nonprofit CommonPass has developed an analogous verification system. Canada has developed the ArriveCAN app, which people entering Canada must use to provide contact information about where they are choosing to quarantine. It does not track a person’s location, and its present purpose is to enforce the Quarantine Act. Presently the ArriveCAN app is only used to facilitate information gathering and it does not function as a vaccination certificate.

Bottom Line

It is important that countries and regions work together to develop a system that will facilitate free movement between countries. COVID-19 verification systems are quickly being developed to allow people to travel and avoid onerous and costly quarantine requirements. While vaccine certificates open the door to concerns about the continued erosion of personal privacy, developers emphasize that using a private encryption network based on a commonly used trust framework could be a solution to verify a person’s COVID-19 status.

The pandemic resulted in great human, economic, and social impact. It is imperative that lessons learned be tallied, reviewed, and addressed. The likelihood of a future crisis that requires the attestation of vaccination or other control is high, and the mandate of countries and private jurisdictions to minimize risk is real. A trusted, high-integrity international framework must be developed, and it must meet privacy best practices while mitigating risk. Verification and validation by third parties is likely the only way to enable cross-border interaction without the complexity of state-to-state frameworks. Effective communication strategies that assure the public of the integrity of the process are needed to reverse the erosion of trust in government and counter negative perceptions.