The debate surrounding vaccine passports to assist with the easing of lockdown restrictions and controlling the spread of COVID-19 continues to raise a number of concerns in the UK.
Although the use of such passports is apparently under consideration, such proposals raise a number of different ethical, scientific and legal issues. A recent Royal Society report sounded a note of caution, suggesting that 12 tests should be met by any such proposal. Among other things, vaccine passports would need to meet various ethical and legal standards, including in respect of data protection.
Apart from privacy issues, other significant concerns include the fact that vaccine passport schemes could lead to prejudice against different groups who are unable to receive the vaccine for various valid reasons (such as pregnancy, or other medical conditions) and the duration of immunity provided by the various available vaccines is also unclear.
The UK Information Commissioner, Elizabeth Denham, voiced her concerns to MPs last month regarding the possible data protection issues surrounding vaccine passports. Although Ms. Denham conceded that some form of vaccine passport could be useful, she also noted that the necessity, efficacy, proportionality and transparency of any such schemes would need to be carefully considered, particularly in the context of digital vaccine passports.
She also noted that such schemes would involve the processing of special category health-related personal data, to which more stringent data protection requirements apply under both the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.
Ms. Denham also touched on various possible human rights and civil liberties issues in the context of such schemes, observing that they had the potential to create a “two-tier” society based on vaccination. She also acknowledged fears that such proposals could effectively lead to the introduction of identity cards.
The security of any personal data processed in the context of a COVID vaccine passport scheme, particularly any special-category health related personal data, would need to be prioritized, as breaches in respect of such data could have serious adverse consequences for individual data subjects. Other key considerations would likely include purpose limitation in respect of personal data collected for the purposes of such initiatives and the carrying out of appropriate data protection impact assessments in advance of any processing, which would doubtless also be emphasized.
Acknowledging the “deep and complex issues” connected with the possible use of vaccine passports, both in connection with international travel and domestically, the UK Prime Minister has announced a UK Government review of the proposition. It will be interesting to see whether the Government is successful in reconciling the different competing interests and anxieties in respect of this matter and, if so, how this will be achieved.