A collection of advocacy groups from across Europe have joined forces to send the EU a strong message regarding vaccine passports concerns.
The open letter they have co-authored is the latest attempt to stop the bloc from blindly buying into a scheme that could end up doing much more harm than it does good.
How far has the EU got with vaccine passports?
Things are moving quickly. On March 17, 2021, the European Commission published proposals for "a Regulation on a Digital Green Certificate". The goal is, of course, to get the continent's economy up and running once more after over a year of restricting the free movement of citizens.
Then, in a debate on March 24, swathes of MEPs got behind an 'urgency procedure' to accelerate the approval of such a scheme. Sources have suggested that the scheme could be rolled out as early as June, when national vaccine drives will start to have a serious effect on Covid transmission.
What does the open letter say?
The letter, signed by groups such as Privacy International, Panoptykon Foundation, and Access Now, decries the lack of safeguards being put in place in relation to both scientific uncertainties and privacy.
Right now, the signatories say, we have little idea of what the future holds. This means there exist "uncertainties pertaining to the duration and type of immunity of vaccinated and recovered persons" that need to be considered. They also contend that the proposals are severely lacking in assurances that these passports will always be used in line with scientific guidance.
There are always privacy issues that arise in these sorts of technology-dependent schemes. The group's identified several things that are sorely missing from the proposals at present, including:
- Clarification that only offline verification established through a public key infrastructure is compatible with principles of "privacy by design".
- Safeguards regarding the use of this technology for "other purposes" by member states at the national level .
- Assurance that these "other purposes" will be outright prohibited/have to be given the green light via legislation.
- Pledges to use data protection impact assessments whenever a new use-case/purpose is proposed.
Once more, a lack of safeguards surrounding surveillance put into place, which risks the EU "exporting a very low privacy standard to the rest of the world".
What other effects could the scheme have?
A situation that could very easily arise in which tests are also incorporated into certificates. The theory is that it could help facilitate movement for those who are yet to be inoculated. But, as the letter rightly points out, the success of this is predicated on the continuation (or introduction, depending on where you are in Europe) of mass, readily available testing. Not all countries are at the same stage with this aspect of their pandemic response.
The signatories also make the point that vaccine passports will make travel and movement particularly difficult for the people in society that need, through no fault of their own, support – more specifically, undocumented migrants and refugees. There are already numerous and unjust legal, social, and economic barriers in Europe that refugees have to face. Making vaccine certification the absolute condition on which services are accessible will cause a lot of people a lot of problems.
This is profoundly unfair for a variety of reasons. Nations with high numbers of citizens heading for Europe – due to poor economic conditions or horrific conflict – will likely have slow vaccine rollouts as a result. They will be the losers in a continent-wide vaccine passport system.
Another problem the letter mentions is that without paper certificates, a lot of people will be excluded from society simply because they don't have access to the correct technology. This would disproportionately affect the elderly and in turn a large percentage of the most at-risk groups. Right now, the proposals suggest it should be paper, digital, or both, but this could, the open letter states, lead to some countries going digital-only.
Have any countries running successful schemes?
There are few countries that have managed to get a working vaccine passport scheme up and running. But there's little we can glean from their success and failures for a number of reasons.
Israel, which is being hailed as a vaccine passport success story in much of the western world, has had major privacy and security problems. Cybersecurity experts in the country have been reporting on the system's failures since the day it was rolled out. This has included highlighting how contact forms containing personal health information were being rerouted to the private Gmail account of a health ministry official and calling out the usage of outdated encryption libraries. Another big issue with Israel's scheme, to give just one of many examples, is how easy the passports are to forge. Tens of thousands of Israelis are currently in Telegram groups offering forged passports.
China also has a vaccine passport program, but only recognizes Chinese-made vaccines. This could be a subtle omen for what's to come; vaccine passports could, in theory, be easily utilized as an instrument to reach specific political ends, particularly in the context of border control, migration, and the mass movement of people.
Denmark is one of the few countries that running a program resoundingly dubbed successful. But Denmark's scheme links a person's vaccine data/status to data from the country's ID system, as well as other health information. This sort of centralized system requires high levels of trust between government institutions and society – as well as between citizens. This is something Danish society has in abundance, but also something many countries lack to such an extent that it may render such a system irreplicable outside of a region like Scandinavia.
Should we be worried?
There seem to be huge swathes of people under the impression that the only reason a person may not have a vaccine is that they've refused to have one. This is profoundly unimaginative and is unlikely to capture the experience of refugees, undocumented migrants, privacy-conscious individuals, sufferers of some immune system disorders, and those who had a bad physical reaction to the first vaccine. This may not be a large group of people, but it matters, and for all we know, post-pandemic travel will throw up all sorts of issues.
The most concerning aspect of this entire situation is the speed at which the EU seems to be pushing vaccine passports. It doesn't feel quite like the gravity of the situation – the imminent demarcation of society based on whether individuals have signed up to and completed a specific medical procedure – has sunk in. This is completely new territory. When things like this are rushed – especially when they relate to data – system vulnerabilities start to arise. This happened in Israel with regard to the outdated encryption protocols the government chose to use.
If this scheme is rushed through and rolled out in rapid fashion, there's every chance that ethical concerns – privacy-related or not – won't be properly thought through, and that is worrying. Open letters – like the one discussed in this article – are one way to mitigate this. The burden is on the EU to listen.