Vaccine passports far more complicated than they might appear

With the numbers of adults that have been vaccinated against Covid-19 rising, the idea of a vaccine “passport” or secure vaccination certificate to verify a person’s immunity status is on the agenda – at least, in the limited parts of the world that have access to vaccines.

In a global context, such discussions are a privileged luxury. But there’s no doubt that, eventually, international calls will grow for vaccine/immune status check systems for travel and entry at venues.

At first glance, this might seems an excellent proposal, a source of reassurance and an important piece of public health protection. This is especially so with travel, where airlines worry that the public may be hesitant to board planes again, confined in small narrow places for hours with strangers that, alas, all need to exhale regularly.

On the other hand, this argument is certainly weakened when you see the significant levels of flight travel happening in the US, even during its last pandemic surge. In most cases, PCR tests are not needed before flying domestically, nor a vaccine card, even though almost every US airline has halted the early practice of keeping middle seats vacant on flights, and people are once again packed into the airborne sardine tin. Still, many of those currently flying would no doubt prefer passengers to provide some assurance that they are not infectious.

Amazon union battle is only the beginning of a bigger conflict

---

Ireland will not fall over if the crutch of low corporate tax is kicked away

---

Ann Riordan showed a woman’s place was at the top

---

Struggling to get your head around NFTs? So is the rest of the world

---

But issuing vaccine passports is far more complicated than it might appear. Such a document would need many interlocking, secure parts, even if the aim is, ideally, to keep the technology as simple as possible, both in use and design; provide some alternative for those who do not have smartphones; and have security, data protection and data privacy as a foundational principle.

And then, there’s the big question: whether such documents should be introduced at all. The International Air Transport Association (IATA) believes not (but nonetheless some individual airlines have said they want them).

Freedom of movement

Many data privacy and protection advocates, including the Irish Council for Civil Liberties, also object, arguing that such documents have serious implications for human rights, on the grounds of discrimination, equality, data privacy, the right to bodily integrity and the right to freedom of movement across the EU. The ICCL laid out its objections in a detailed letter last month to Minister for Foreign Affairs Simon Coveney.

The World Health Organisation (WHO) has expressed reservations on many of the same points, concerned that many countries will remain without vaccines for a long time, leaving citizens unable to travel internationally at all. With uncertainty still over whether people can transmit the virus after being fully vaccinated, the WHO also believes such passports could encourage those with them to stop taking adequate precautions when flying.

However, with the EU announcing proposals for a document, and some US states and regions already issuing their own versions, a passport or certificate looks inevitable. The challenge then will be the format such an item will take.

Perhaps, like me, you initially thought that a vaccine passport meant a notice that would go inside an actual national passport, similar to the vaccination documents and stamps that have long been required for travel to some destinations.

But carrying around a passport is impractical and risky. Instead, some kind of digital certificate is generally the focus. And here, the US and EU chasm on data handling issues is apparent.

Domestic solutions

Late last month, the European Commission showed proposals for a QR code-based Digital Green Certificate that can be downloaded onto a phone or printed out. These would be issued to those who have been vaccinated, recovered from Covid or have a negative test before a travel, so are not strictly "vaccine" passports. The commission has stated a minimal amount of information will be available to the certificates and that databases will not be linked into a huge directory of health status. Health information is considered particularly sensitive under the General Data Protection Regulation and must be handled and protected within more stringent rules.

However, various member states have also indicated they might come up with domestic passports of some sort, as has the UK.

The US, meanwhile, has taken the usual US line: let private industry sort out a solution. President Joe Biden made clear in a public statement that the federal government had no intention of introducing a vaccination document beyond those already issued by the US national Centres for Disease Control and Prevention to show individual vaccinations have been completed. These are already being used as "vaccine passports" (Ireland accepts them). But the concern with these is that they are easily lost or counterfeited. Already, fake blank certificates are selling on eBay.

The notion that US private industry will embrace a mass data management option, without wanting to monetise that sensitive data – data acquisition and exploitation being a favourite and widespread business model – raises significant concerns. As does the worry that states and countries might end up with an incoherent mishmash of “passports” and “certificates” with varying levels of security.

Hence the usual question: what could possibly go wrong?