Vaccine passports could prove to be a privacy minefield for regulators

When the EU announced its plans for a “digital green certificate” this month, the tourism industry breathed a sigh of relief that maybe summer could be salvaged. 

Since the onset of the coronavirus pandemic, the concept of a “vaccine passport” has been floated regularly. Once inoculated against Covid-19, a person could carry proof of vaccination that would allow them to travel or access services that are otherwise shut under lockdown.

The EU’s certificate, which avoids using the term “passport,” would create a common digital system for Europe, likely in the form of a smartphone app, to prove vaccination, a negative test or that they have recovered from the virus.

EU Justice Commissioner Didier Reynders said a common EU-wide approach to such a certificate would “gradually restore free movement” in the region.

“It is also a chance to influence global standards and lead by example based on our European values like data protection,” he said earlier this month.

Different industries around the world have been tinkering with these passes for months.

IBM is working with New York State on a digital health pass that uses blockchain technology to verify a person’s test or vaccine credentials and Walmart, which is carrying out shots in its stores, recently backed calls for vaccine certificates.

Apple and Google previously collaborated on creating standards for contact tracing in smartphones. The EU has suggested that the tech giants might collaborate again on these efforts with the World Health Organization, but the WHO has since denied this.

Now as vaccine rollouts gather pace, the prospect of these digital passports or certificates have caught the eye of many different industries.

The aviation and tourism industries — both brutalized over the last year — have been the keenest to pursue this technology to re-open global travel.

The International Air Transport Association introduced its “travel pass” late last year and launched a trial with Singapore Airlines this month.

Initially created to show proof of a negative test, the app will be expanded to show proof of vaccination as well, according to Katherine Kaczynska, assistant director of corporate communications at IATA.

Kaczynska added that IATA is not in favor of mandating vaccines for travel, but the industry group instead views the app as one way to help open up international travel.

Ultimately the system will be integrated into an airline’s own app but there needs to be cohesion in how various vaccine passport proposals are launched and operated, Kaczynska told CNBC.

“We’re working closely with governments because we need to make sure things are interoperable,” she said.

“It’s the governments that need to come out with a standard for digital vaccine certificates and then we need to make sure that works with the IATA Travel Pass and with other apps out there. Ours is specifically focused on aviation but for it to work there will obviously need to be interoperability between different standards.” 

Given the sensitive health-related data at play, launching any digital service raises questions around privacy and data protection. 

IATA is working with Evernym, a blockchain firm that’s worked on various projects for digital decentralized identities, including a project with the Red Cross.

“The main thing with the IATA Travel Pass is that it’s decentralized technology, which basically means that all the data is not stored on a central database in any way at all. All the data is stored on the passenger’s phone,” Kaczynska said.

According to the European Commission, the EU’s executive arm, its proposed system will only require “essential information.” This includes vaccine or test data and a unique identifier for the certificate.

Nicole Hassoun, a professor at Binghamton University specializing in ethics in public health, said deploying any kind of vaccine passport on a mass scale needs careful thought.

As vaccines are distributed in a patchwork of demographics, passports or certificates need to consider exemptions to avoid any discrimination for people that are not yet vaccinated or have health reasons for not being vaccinated, she said.

“Maybe you would allow some kind of passport system but then there have to be health exceptions. There have to be welfare exceptions for people who really have good reasons that they need to access these services (such as travel),” Hassoun told CNBC.

This is partly why the EU proposal doesn’t focus solely on vaccination and includes negative tests.

One particular concern is that vaccines are still very new. While data coming out of countries like Israel shows promise, more data is needed to verify just how effective the various vaccines are at reducing transmission and what long-term immunity will look like, Hassoun added.

“We need more data about what the effects on transmission are for people that are vaccinated or people who might have natural immunity, how long will that last? What happens when there are new strains?” she said.

“We need to pay attention to what the private sector is doing as well as what governments are doing and make sure that we regulate if we have to and make sure that they’re fair to everybody.”

She warned that the provision of passports and certificates need to be equitable as currently the rollout of vaccines themselves is not. While Western nations like the U.K. and U.S. forge ahead, others are left behind, such as Brazil, which has suffered some of the world’s worst outbreaks and is struggling with its rollout.

For the EU, which is facing its own supply issues amid disputes with AstraZeneca, the clock is ticking to have the digital green certificate ready for the summer season. 

The framework will require speedy perusal and adoption by the European Parliament and Council if Europe and its tourism sector is to avoid a second lost summer.