Vaccine passports: key to reopening or unfair and divisive?

With the roll­out of mass vac­ci­na­tion pro­grammes against coro­n­avirus in a num­ber of coun­tries, many are begin­ning to con­tem­plate doing every­day things again, from going to the cin­e­ma to tak­ing a hol­i­day or attend­ing a con­cert. How­ev­er, with cas­es still high and wor­ries about new vari­ants emerg­ing, busi­ness­es and gov­ern­ments are increas­ing­ly like­ly to want proof peo­ple have had a jab and there­fore pose less of a health risk.

Already, both Aus­tralian air­line Qan­tas and UK cruise firm Saga have said their pas­sen­gers will need to have been inoc­u­lat­ed to trav­el with them in the near future. Lon­don-based plumb­ing busi­ness Pim­li­co Plumbers, mean­while, says vac­ci­na­tion will be a con­trac­tu­al oblig­a­tion for new and exist­ing staff, although employ­ment lawyers have raised con­cerns over how this would work in prac­tice.

The ques­tion is how will peo­ple prove their vac­ci­na­tion sta­tus, par­tic­u­lar­ly if it is request­ed mul­ti­ple times a day. So-called vac­cine pass­ports are being tout­ed as the most like­ly answer.

Ice­land has already start­ed issu­ing vac­cine cer­tifi­cates to cit­i­zens who have had two vac­cine shots to enable them to trav­el. Den­mark has also revealed plans to launch a vac­cine pass­port, ini­tial­ly as a sim­ple form that shows whether some­one has been vac­ci­nat­ed but with plans to devel­op a full dig­i­tal pass­port in the com­ing months. 

The benefits of a digital passport

The idea behind a dig­i­tal vac­cine pass­port is that peo­ple would down­load and present their med­ical records on their smart­phones in an encrypt­ed, yet ver­i­fi­able, way. 

Most coun­tries cur­rent­ly issue proof of vac­ci­na­tion in the form of paper cer­tifi­cates, for exam­ple a GP surgery will give trav­ellers a paper cer­tifi­cate to prove they have had a yel­low fever jab. But crit­ics say these can be eas­i­ly forged, are not uni­ver­sal­ly recog­nised and a more prac­ti­cal dig­i­tal alter­na­tive is need­ed.

Tech­nol­o­gy and health­care com­pa­nies from around the world are now work­ing to make vac­cine pass­ports a real­i­ty. Take, for exam­ple, Com­mon­Pass, a health trav­el app being tri­alled by major air­lines, such as Unit­ed and Vir­gin Atlantic, and the World Eco­nom­ic Forum. 

Users would be able to upload their vac­ci­na­tion records or Covid-19 test results into the app, which turns them into a unique­ly gen­er­at­ed “dig­i­tal health cer­tifi­cate” in the form of a QR code. This can be shown to author­i­ties with­out reveal­ing sen­si­tive iden­ti­fy­ing infor­ma­tion, such as someone’s name or address.

Then there is the Vac­ci­na­tion Cre­den­tial Ini­tia­tive, a coali­tion of organ­i­sa­tions includ­ing the non-prof­it health­care com­pa­ny Mayo Clin­ic, as well as tech­nol­o­gy firms Microsoft and Ora­cle, that is work­ing to devel­op com­mon tech­ni­cal stan­dards to under­pin such apps.

It fol­lows a plea by the World Health Orga­ni­za­tion for open, inter­op­er­a­ble stan­dards, amid fears that count­less indi­vid­ual pass­port apps will be cre­at­ed, mak­ing them unus­able. 

How­ev­er, there are seri­ous bar­ri­ers that could stop vac­cine pass­ports get­ting off the ground. First­ly, no one knows how long the immu­ni­ty pro­vid­ed by the new vac­cines will last or whether they will stop peo­ple from trans­mit­ting the virus. If vac­cines can’t con­tain the cri­sis, then vac­cine pass­ports will serve lit­tle pur­pose.

Protecting patients’ rights and freedoms

Pass­ports also pose “essen­tial ques­tions” about pri­va­cy and data pro­tec­tion because they depend on access to peo­ple’s pri­vate med­ical records, says Dr Ana Beduschi at the Uni­ver­si­ty of Exeter Law School. This means pol­i­cy­mak­ers are going to have to think care­ful­ly before they give tech firms unfet­tered access to patients’ records. 

There are eth­i­cal con­cerns too because pass­ports “cre­ate a new dis­tinc­tion” between indi­vid­u­als based on their health sta­tus and can be used to deter­mine the degree of free­doms and rights they may enjoy.

“Take the hypo­thet­i­cal sce­nario in which pub­lic author­i­ties would require every­one to rou­tine­ly dis­play their health to access pub­lic and pri­vate spaces such as pub­lic trans­port, restau­rants or church­es,” Beduschi explains.

“Such mea­sures would restrict con­sid­er­ably the rights and free­doms of those who have the dis­ease or did not receive a vac­cine.” 

Some peo­ple may not be able to have the jab for health rea­sons, oth­ers may sim­ply not want it. Then there are those who do not have smart­phones or access to sta­ble inter­net con­nec­tions, all of whom could argue that not hav­ing a pass­port breach­es their rights to equal­i­ty and non-dis­crim­i­na­tion.

Is anonymity the answer?

Devel­op­ers are alive to these issues and stress their apps are secure. Take the pass­port cre­at­ed by iProov, a UK bio­met­rics start­up, and cyber­se­cu­ri­ty firm Mvine that is cur­rent­ly part of a gov­ern­ment-fund­ed tri­al. 

Sim­i­lar to Com­mon­Pass, med­ical pro­fes­sion­als admin­is­ter­ing the vac­cine would cre­ate an online cer­tifi­cate in the form of a QR code via the app, but they would also ask the vac­cine recip­i­ent to have a self­ie added to the cer­tifi­cate. 

When the hold­er want­ed to show the cer­tifi­cate, at a restau­rant or venue for exam­ple, they would present the code and then ver­i­fy their face against the attached image via the app.

“The cer­tifi­cate does not need to include the name, address, NHS num­ber or any oth­er iden­ti­fy­ing infor­ma­tion about the per­son; it is com­plete­ly anony­mous,” says iProov founder and chief exec­u­tive Andrew Bud. “It also doesn’t dis­crim­i­nate against peo­ple based on the smart­phone they own and there is a route for peo­ple who do not pos­sess a smart­phone, a card-based method.”

How­ev­er, Bud says it will ulti­mate­ly be up to pol­i­cy­mak­ers and health offi­cials to address the legal, social and polit­i­cal ques­tions around pass­ports if a solu­tion like his is to go for­ward. 

Many prob­lems that seemed insur­mount­able at the start of the pan­dem­ic have been over­come and many believe this will be the case with bar­ri­ers to vac­cine pass­ports.

Lucy Yang, com­mu­ni­ty direc­tor of the Covid-19 Cre­den­tials Ini­tia­tive (CCI), anoth­er group work­ing on shared stan­dards for pass­ports, says coro­n­avirus expo­sure noti­fi­ca­tions faced sim­i­lar eth­i­cal and pri­va­cy bar­ri­ers.

“With­in a few months, more than 20 states in the US and 20 coun­tries had adopt­ed expo­sure-noti­fi­ca­tion apps. If they achieved it, I don’t see why we can’t,” she says.

How­ev­er, Yang explains, pass­ports are unlike­ly to have as big an impact with­out shared stan­dards; agree­ing on them “won’t hap­pen overnight”. In addi­tion, while she thinks the tech­ni­cal chal­lenges can be over­come, she’s less sure about the oth­er bar­ri­ers.

“Hope­ful­ly CCI will launch a pilot in the next two to three months with mul­ti­ple juris­dic­tions, then we will know bet­ter if it works. But the big­ger chal­lenge will be putting the right rules in place. Who should be issu­ing vac­cine cre­den­tials in the first place and who should be ver­i­fy­ing them?”