Statement on the Development and Deployment of Digital Green Certificates

 

At an early stage of the global COVID-19 pandemic, the Association for Computing Machinery’s Europe Technology Policy Committee¹ (Europe TPC) addressed technical considerations inherent in the development and deployment of contact tracing technologies in the public interest.² Medical, political and social developments have now encouraged policy makers to propose technical means by which travel and economic activity within, and perhaps outside, the European Union may resume more freely and safely.

Europe TPC has reviewed recent governmental proposals and key related independent analyses³ for the creation and use of such “Digital Green Certificates” (Certificates) to permit point-of-use access to personal health and other data of Certificate holders in an interoperable manner between and among European Union Member States. We commend the European Commission for its legislative proposal,⁴ guidelines and associated explanatory materials to date,⁵ as well as the recent Joint Opinion of the European Data Protection Board and the European Data Protection Supervisor⁶. (Europe TPC particularly supports proposals to use both paper-based and electronic versions of Certificates to mitigate the danger of digital exclusion.)

Building upon this detailed preparatory work, we offer the following recommendations with respect to the technology underlying Digital Green Certificates and the sensitive personal data to which, by design, they are intended to afford access. We hope that they will be useful to the Parliament and Council as they consider amendments to the European Commission’s 17 March Proposal, and to the Commission itself in ultimately crafting and implementing a final Regulation. Europe TPC respectfully suggests that such regulation call for the European Union to:

1. Work, ab initio, with the World Health Organization (WHO) to develop an international Public Key Directory (PKD), rather than a purely intra-European or EU standard. We fully understand the social and economic incentives for the rapid introduction of Certificates to facilitate free movement during the upcoming European holiday season. Development of a European PKD, however, poses significant risk that the system developed may lead to interoperability issues with non-EU countries. We also understand that development of a global standard is more difficult and time-consuming. Accordingly, if an international solution cannot be developed in a timely fashion, we recommend that the Parliament and Commission pursue an interim solution of also developing direct trust establishment mechanisms between EU Member States and some non-EU countries while also working closely with the WHO to devise and deploy a truly international PKD.
2. Develop Certificate technology and policy to ensure that information disclosure is proportionate to the nature of the immediate need for that information. We note that EU proposals are focused mainly on freedom of movement across EU internal borders. It is almost inevitable, however, that there will be pressure to allow Certificates to be used for other purposes, such as admission to commercial establishments and entertainment venues. In such an eventuality, it will be important to ensure that verifiers of Certificates are not able to access sensitive medical information irrelevant to the determination that must be made at the Certificate’s point of use. We thus recommend that the Commission evaluate and adopt “differential privacy” solutions, such as the “I Reveal My Attributes” protocols articulated by the Privacy by Design Foundation.⁷ Certificate holders also must be able to easily verify the content of their own Certificate and to effectuate the prompt correction and removal of incomplete or erroneous information.
3. Prioritize the protection of EU citizens from “data inference.” As noted in the EDPB-EDPS Joint Opinion, until the vast majority of the population has been vaccinated, there is the risk that a verifier could infer secondary health data from an individual’s vaccination status alone. For example, younger people who have already been vaccinated may also have some other underlying health condition that has raised their priority ranking. If not precluded, such inferences could serve as the bases for curtailing freedom of movement or even to deny employment. While the technical safeguards endorsed in the preceding point may mitigate against this, as the EDPB-EDPS Joint Opinion suggests, the use of Certificates should be monitored closely.
4. Maximally limit Certificate data retention. Europe TPC strongly endorses the call at Paragraph 29 of the EDPB-EDPS Joint Opinion to amend Recital 42⁸ and Article 15 of the Commission’s 17 March 2021 Proposal to make clear that Certificates and the data collected for them should only be retained for the duration of the current COVID-19 pandemic. In particular, we support the recommendation to delete the phrase “or similar infectious diseases with epidemic potential,” in order to comply with the principle of purpose limitation.

• ^* Principal member authors of this document for ACM’s Europe Technology Policy Committee are Michel Beaudouin-Lafon and Chris Hankin, with the editorial contribution of Manuel Hermenegildo.
• ¹ The Association for Computing Machinery (ACM) is the world’s largest and longest established professional society of individuals involved in all aspects of computing. It annually presents the ACM A.M. Turing Award, often popularly referred to as the “Nobel Prize of computing.” ACM’s Europe Technology Policy Committee (Europe TPC) is charged with and committed to providing technical information to policy makers and the general public in the service of sound public policy formation. ACM and Europe TPC are non-profit and non-lobbying organizations.
• ² See Statement on Essential Principles and Practices for Covid-19 Contact Tracing Applications, ACM Europe Technology Policy Committee (5 May 2020) (https://www.acm.org/binaries/content/assets/public-policy/europe-tpc-contact-tracingstatement.pdf)
• ³ Europe TPC endorses the broad principles that should inform the development of Digital Green Certificates identified by both the United Kingdom’s Royal Society and the Ada Lovelace Institute.
• ⁴ Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic, European Commission (17 March 2021) (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0130)
• ⁵ Questions and Answers – Digital Green Certificate, European Commission (17 March 2021) (https://ec.europa.eu/commission/presscorner/api/files/document/print/en/qanda_21_1187/QAN_DA_211187_EN.pdf)
• ⁶ Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery (31 March 2021) (https://edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-042021-proposal_en)
• ⁷ IRMA in detail, Privacy by Design Foundation (undated) (https://privacybydesign.foundation/irmaexplanation)
• ⁸ Recital 42 states: “In accordance with Recommendation (EU) 2020/1475, any restrictions to the free movement of persons within the Union put in place to limit the spread of SARS-CoV-2 should be lifted as soon as the epidemiological situation allows. This also applies to obligations to present documents other than those required by Union law, in particular Directive 2004/38/EC, such as the certificates covered by this Regulation. Therefore, the Regulation’s provisions on the “Digital Green Certificate” framework for the issuance, verification and acceptance of interoperable certificates on COVID-19 vaccination, testing and recovery should be suspended once the Director-General of the WHO has declared, in accordance with the International Health Regulations, that the public health emergency of international concern caused by SARS-CoV-2 has ended. At the same time, their application should resume if the Director-General of the WHO declares another public health emergency of international concern due to an outbreak of SARS-CoV-2, a variant thereof, or similar infectious diseases with epidemic potential. Where this is the case, the provisions concerned should again be suspended once that public health emergency of international concern has ended” (emphasis added).

PDF available here.