The EU’s COVID-19 Certificate: Lifting the restrictions in a coordinated manner or breaching the right to privacy?
Source: European Commission
By Marina Veljkovic, 6 minutes.
Covid-19 and the return of free movement
The unprecedented Covid-19 pandemic has challenged human rights and the rule of law. Extreme measures such as lockdowns and curfews were experienced by numerous European countries as efforts to reduce the risk to public health. These endeavours are deemed intrusive, however, the emergency and the danger of the situation demanded governments act swiftly while respecting principles of necessity and proportionality.
And while there is an evident need for extraordinary measures and restrictions, checks and balances must be in place to ensure the protection of fundamental rights.
With the rising number of vaccinated people, opening businesses, travelling and returning to normal life finally seems hopeful. An initiative discussed in many EU member states, as well as in some other countries, such as the UK and Israel, is to implement the so-called “vaccine passports” - documentation providing proof that a person holding it is immune to Covid-19. The European Commission transformed this approach into a concrete document and presented a proposal for the digital Green Certificate. The Digital Green Certificate has been since renamed as “EU COVID-19 certificate”, as agreed on, by the Members of the European Parliament. This initiative aims to facilitate the free movement of citizens within the Union during the pandemic and allow for the opening of businesses.
How will the “EU COVID-19 certificate” work?
The EU COVID-19 Certificate will serve as digital proof that a person has either been vaccinated against the virus, has received a negative test result, or has recovered from Covid-19. The certificate was supposed to be available both in digital and paper form.
Similar approaches have been explored by different countries and proposals have been made that immunity passports should take the form of apps, wristbands and aforementioned digital certificates.
Regardless of the form, all such immunity certificates will have access to the country's official health records, as well as the information necessary to identify the individual behind the records. The highly personal nature of this information raises concerns in relation to data storing and protection. Essentially, it is questioned whether this form of selective surveillance endangers the fundamental right to privacy.
The right to privacy
The right to private and family life, home and correspondence is protected by Article 8 of the European Convention on Human Rights (ECHR), a convention signed by 47 European countries, all members of the Council of Europe.
Health data directly relates to Article 8, as the European Court of Human Rights in Strasbourg, ruled in several cases. In Z. v Finland, the Court found:
“… the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention.” (Z v. Finland, App. No. 22009/93, ECHR, 25 February 1997).
Furthermore, Article 9 of the General Data Protection Regulation (GDPR) stipulates that because of its sensitivity, data concerning health falls under a special category of personal data and enjoys a larger degree of protection. Accordingly, using health data without an individual’s permission is unlawful and indeed goes against the right to privacy.
Nonetheless, in the situation of weighing public health versus the individual’s right to privacy, one is likely to logically conclude that public health in the times of Covid-19 might outweigh the basic right to privacy. And righteously so.
The governments thus have to ensure that the encroachment of the right to privacy, in connection to the gathering of health data necessary for Covid-19 certificates, is proportional and justified. In this sense, gathering information necessary for the identification of an individual as well as their immunity data seem feasible. The EU, as well as the Member States, would need to guarantee safe gathering and protection of this information. In terms of data protection safeguards, on Thursday, April 29th, in the European Parliament plenary session, it has been concluded that the data obtained from Covid-19 certificates will not be stored in a centralised government database. In addition, the Covid-19 certificates are planned to be in use for no more than 12 months.
With respect to the transparency of health data privacy, such a storage system is preferable over a centralised database, as this way, data is less likely to be accessed and abused by third parties.
Moreover, the EP affirmed that destination Member States will not be able to store information obtained from the certificates and that all entities empowered to receive and process data will be publicly listed in order to ensure that all citizens can exercise their data protection rights under the GDPR. The certificates and the electronic seals included in the document will also go through a process of verification for the sake of ensuring authenticity and preventing forgery and fraud.
Discrimination
An additional concern has been repeatedly stressed in relation to the unjustifiable indirect discrimination risks against those who are unable to receive vaccination as well as the infected and non-immune population.
Some of the groups found to be the most likely to face unintentional discrimination are people with disabilities, some of which are unable to receive vaccinations because of their health conditions, or the youth, as they are less likely to be vaccinated than their elders. Another societal division may come on the basis of sex or maternity because pregnant women are advised against vaccination. Such stratification of the society could possibly foil the existing plan of easing the transition to the life we knew before.
In contrast, less discriminatory means could be imposed as a prerequisite for travel, such as obligatory antigen tests, which are already widespread and in use.
In order to avoid discrimination against the non-vaccinated population because of the implementation of COVID-19 certificates and due to economic reasons, the Members of the European Parliament reiterated that the Member States should “ensure universal, accessible, timely and free of charge testing”.
Whether this is sufficient to eliminate potential discrimination, will be determined once the certificates enter into use. The voluntary character of the vaccination, as well as the unequal distribution of vaccinations in different Member States, sincerely challenge the requirement for non-discrimination.
Council of Europe issues guidance to governments to safeguard human rights
On April 14th, 2021, the Council of Europe published a document, highlighting relevant human rights standards European governments should appease in relation to vaccine passports. The Council encourages harmonisation in the context of travelling and vaccination, immunity and non-infection certification as long as personal data is protected, and fraudulent behaviour actively eliminated. All 47 member states were also called to take action in line with the Convention for the protection of individuals with regard to automatic processing of personal data (Convention 108), the Convention on the counterfeiting of medical products and similar crimes involving threats to public health (MEDICRIME Convention) and the Convention on cybercrime (Budapest Convention).
Ensuring public health and simultaneously protecting fundamental rights is one of the biggest challenges of the Covid-19 pandemic but checks and balances must be in place to guarantee minimal interference with human rights. Whether Covid-19 certificates are seen by sceptics as merely a promotional strategy for travelling this summer or whether they are an actual assurance of safe movement in the European Union, they are a step forward. As the Commission President, Ursula von der Leyen stated, “The Digital Green Pass (now, Covid-19 Certificate) should facilitate Europeans' lives.", and maybe this summer will facilitate exactly the latter, a breath of Covid-free European life.