EU health certificate to enable travel during summer holidays

The political pressure around the Green Digital Certificate is great and comes from different sides. Understandably, the private sector wants the certificate as soon as possible in order to be able to plan and sell. They also want it to be easy to use for the public and the authorities. For example, one should be able to quickly prove a Covid vaccination at the cinema box office. Political pressure also came early on from holiday countries such as Austria, Greece, Cyprus, Spain and Italy, which are pushing for a less binding but more quickly introduced vaccination certificate.

One of the Commission's main concerns is to ensure general acceptance of the passport in Europe, because the GDC Germany and France in particular initially did not want to introduce a GDC so quickly and there were warnings against exaggerated expectations of the vaccination passport. Merkel and Macron had initially spoken out against preferential treatment for those who had been vaccinated, as too few people still had a chance to receive the protective vaccination. At the time of writing, according to figures from the European Centre for Disease Prevention and Control, less than 5% of all EU citizens are fully immunised. The EU hopes to raise the rate to 70% by the end of the summer.

But with the most far-reaching relaxation of covid laws in the UK on 17 May and the upcoming German federal elections in September 2021, the pressure on governments to deliver is rising steadily, and they do not want to risk being accused of wasting opportunities for personal freedoms and the economy on election day. Thus, the Vice-President of the EU Commission Margaritis Schinas also called for a faster introduction of the vaccination card in mid-March. In an interview with the Frankfurter Allgemeine Zeitung, Schinas fears that the private sector could otherwise beat the EU to the punch with its own less desirable stopgap solutions, which is why the Commission is also under additional time pressure.

• October 2020: Attempt to quickly introduce a contact tracing system throughout the EU does not succeed; only 21 countries have coordinated their mobile phone apps by the end of March 2021.
• Beginning of 2021: First prospects for a vaccination passport, technical cornerstones defined
• 17 March: Draft law of the EU Commission on the Green Digital Certificate GDC (2021/0068 (COD) and proposal for a regulation on third-country nationals (2021/0071 (COD)
• 25 March: European Parliament approves fast-track legislative procedure with 468 votes in favour, 203 against and 16 abstentions.
• 14 April: 27 EU ambassadors give green light for introduction of GDC
• 18 April: EU Competition Commissioner Thierry Breton announces introduction of GDC by end of June at the latest
• 26-28 April: EU Parliament debates contentious issues with member states and Justice Commissioner Didier Reyners
• 29 April: EU Parliament's final vote on draft regulation did not go as expected - although Parliament votes in principle for introduction by 540 votes to 119, it does so subject to other conditions, such as a maximum deployment period of 12 months and free corona testing to put non-vaccinated people on an equal footing in all countries. The "Green Digital Certificate" is to be renamed "EU COVID-19 Certificate" to indicate the differences. Commission and Parliament enter into further negotiations.
• May: technical preparatory work at national level with private IT companies and logistical preparatory work with national issuing bodies of the certificates in the 27 Member States.
• Early June: pilot phase, linking and testing of systems
• Mid or end of June: mass launch, most recently EU Justice Commissioner Reynders named 21 June as the launch date.
• Summer: Commission creates infrastructure to verify the authenticity of the Digital Green Certificates. Member States link their own vaccination databases to the Commission's data portal.

The GDC should apply in all EU member states as well as Schengen countries such as Iceland, Liechtenstein, Norway, Switzerland and in European micro-states. If governments nevertheless assess the risk of covid spread differently, the rules in the individual countries may differ. However, if quarantine and tests are still required for travellers with a certificate, this must be reported and explained to the EU Commission and the other EU states. In one EU state, GDC holders might still have to take a quick test on entry, but not in another. A binding unified risk classification was therefore not included in the EU regulation, as it might have caused a blockade of individual member states, says EU Commissioner for Justice Didier Reynders. They did not want to repeat the mistake of the failed EU-wide contact tracing in autumn 2020, which still does not work across borders everywhere.

The Commission's proposal for a vaccination certificate beyond the EU is open to global initiatives by the United Nations, such as the World Health Organisation (WHO) or the International Civil Aviation Organisation (ICAO). The aim is for the certificates to become compatible with the systems of third countries, and third countries will be encouraged to recognise the GDC in return. According to Reynders, the vaccination certificate should remain in the EU's "toolbox" for possible future epidemic emergencies and adhere to international standards. However, the EU's negotiating position is that certificates issued by third countries would only be accepted if they were created under the same conditions as the GDC.

For a start, however, the key word is "resident" - i.e. nationals of third countries with registered residence in the EU have the same entitlement to the certificate as EU citizens. This means, however, that US citizens who do not live in the EU cannot obtain the GDC for Europe if they only want to spend their holidays here.

In order not to do without this tourism income, individual countries, such as France's President Emmanuel Macron announced, want to introduce a "Covid-19 passport" for certain third-country nationals that is independent of the GDC. Such an agreement is already in force in Greece and Cyprus, where Israeli tourists can go on holiday with an Israeli Covid-19 vaccination passport. The best prospects for special rules are the leaders in vaccination coverage Israel with 62.3%, the UK with 49.9% and the USA with 42.4%. The EU average in comparison is currently 21.1%. (As of 27.4. Source)

In order to prevent discrimination against non-vaccinated persons and to emphasise that the green certificates should not be considered as a second passport, the Council has agreed to insert the sentence "This certificate is not a travel document" at the bottom of each document. Thus, it is envisaged that the vaccination certificate will not be a requirement for travel within the EU, but will only facilitate border crossings. With the passport, countries can waive existing testing and quarantine obligations. The GDC Travellers can show the GDC on their smartphone or as a printed piece of paper. The printout (or the mobile phone display) contains a QR code to prevent misuse. The GDC Whenever GDC holders present it, the QR code is scanned and the digital signature is verified.

No. Citizens will receive a QR code free of charge from their doctor or at the vaccination and testing centre, which they can print out or save on their mobile phone. So no mobile device is needed, the certificate with personalised QR code will also be available on paper. When scanning this code, all necessary data can then be retrieved. In addition, the QR code will contain a digital signature to make the certificate forgery-proof. The EU police authority Europol has already warned that criminals could try to trade in forged certificates. 

In addition, owners of a smartphone can scan the QR code into a specially designed app and manage it there. For the same purpose, they can also use the already existing state Corona warning app of their country.

According to the news channel France24, 68% of French people were against a vaccination card at the end of March due to data protection concerns. There has been strong opposition to a central EU vaccination register from data protectionists in the run-up, and a data protection committee has conducted a review and summarised its proposals. The EU Commission stresses the DGC's full compliance with the General Data Protection Regulation (GDPR). Moreover, there is to be no central database at EU level. Likewise, no sensitive personal data will be stored in the DGC or exchanged in the EU digital gateway. By the end of May, the Commission wants to have developed this interface, which allows the exchange between all Member States and makes do with a minimum of data. The data should neither be stored centrally nor remain longer than absolutely necessary under high protection measures for personal and medical data protection. Instead of a centralised solution, the DGC will only be accessible from national databases via the gateway. It is important that the information transferred cannot be misused for the private companies involved in the development of the infrastructure for their own purposes. Moreover, the DGC will only remain in use as long as Covid-19 is classified as a pandemic by the World Health Organisation.

The following data are stored in the GDC:

• First name and surname
• Date of birth
• Validity date
• Issuing Member State
• Unique identifier (QR code) with digital signature
• For vaccinated travellers:
  • Vaccine product and manufacturer
  • Number of doses
  • Date of vaccination
• For tested travellers:
  • Type of test
  • Date and time of test
  • Test centre and result
• For travellers with survived Covid disease:
  • Date of positive test result
  • Issuer of the recovery certificate
  • Date of issue
  • Period of validity (calculated duration of immunity)

There is no obligation to use the GDC, but in Austria it is not possible to deregister from the electronic vaccination certificate after a CoV vaccination, because such a vaccination may not be carried out without an entry in the digital vaccination certificate. This means that data must be stored for every vaccination. Opting out, as is the case with the ELGA electronic health record due to concerns about the security of sensitive data, is impossible from the vaccination card itself, regardless of the GDC. The QR code on the ampoule is scanned and stored both in the ordination system and in the electronic vaccination card. Access to this data is only possible with ELGA access and a mobile phone signature.

The Green Digital Certificates will be available to all EU citizens and residents free of charge and costs will be borne by the issuing Member State. The infrastructure that ensures compatibility at EU level (gateway) will be financed by the Commission.

In the EU Council as well as in the EU Parliament, there was a dispute about how to deal with vaccines that have not yet been approved by the EU Medicines Agency (EMA). This concerns Hungary, for example, where both the Russian vaccine Sputnik V and the Chinese Sinopharm are vaccinated. 

Here, positions differ; some country representatives demand that individual states, at their own discretion, be able to require retesting of persons crossing borders with vaccinated but insufficiently tested vaccines. Others generally do not want to have these vaccines in the GDC in order not to jeopardise the overall project and the uniformity and usability as well as the quality standards of the system.
In total, the European Union has ordered about 3 billion vaccine doses. This corresponds to more than 6 doses per inhabitant. Emmanuel Macron estimates that about 2.5 billion vaccine doses will be produced in the EU itself this year and therefore there will be no need for Sputnik and Sinopharm. Of course, not everyone shares this assessment and rejects a worse treatment of Chinese and Russian vaccines, as was shown, for example, in the vote of the EU Parliament.

To ensure that the tests listed in the certificates are reliable, only so-called NAAT tests (including RT-PCR tests) and rapid antigen tests are approved. The list of these tests has been drawn up on the basis of Council Recommendation 2021/C 24/01. Self-tests are excluded due to lack of EU-wide verifiability.

The validity of GDC certificates depends on the current state of scientific knowledge about the safety of vaccination protection. This means that individual certificates may still be subject to change - for example, if a vaccine is no longer sufficiently effective against a new viral mutation. It also depends on expected research results whether survived Corona infections should also be considered as complete vaccination protection. Based on this, national testing centres will issue the certificates accordingly and can therefore be adjusted on an ongoing basis.
However, the Commission has provided that the validity of certificates from other Member States should be accepted in the GDC according to the same rules as certificates from national certification bodies. The Regulation also introduces some basic principles, such as setting a maximum validity period of 180 days. As a rule, therefore, the 6-month validity will be issued by vaccination centres and, in the case of recovery and the detectability of antibodies, by the hospital, general practitioner or paediatrician. In general, however, the states themselves decide which experts or institutions may issue the GDC.

Estonia is one of the most digitised societies in the world, and has enshrined internet access as a fundamental right in its constitution. The country is working on introducing a nationwide QR vaccination passport by the end of April. When entering a fitness studio or a shop, for example, a vaccinated person is preferred and shows the app together with an identity card. Estonia's Minister of Social Affairs Hanno Pevkur promised to be part of the EU vaccination passport from day 1. 
Italy already operates "Covid-free" train services, for example, carrying only negatively tested passengers. The government plans to extend this testing requirement in low-risk yellow departments (currently 6) to attend sporting and cultural events. Currently, people are allowed to travel between two yellow-marked regions without a vaccination card. The situation is different in high-risk regions marked in red. Here, free travel is only possible with a "green passport". This document is currently only available in paper form and is being prepared in a digital version with a QR code. The passport contains test results not older than 48 hours, information about vaccination or recovery correspond to the GDC.
France has the Tous Anti Covid app in use for concerts, contact tracing and for flights to Corsica and extraterritorial areas overseas, for example. The French test run of the app will be extended from 29 April and will then also include vaccination certificates.
The Netherlands' Back to Life concept lets people take part in live events if they scan a QR code with a negative test result into an app at 8am on the same day. About a third of Dutch people have been vaccinated with the first dose, and restaurant gardens were allowed to reopen for the first time on 28 April.
Denmark wants to roll back travel restrictions on 21 May, the date when all high-risk groups and over-50s in the country should have been vaccinated. With the so-called Danish Coronpas, which contains information about vaccination, infection in the last 12 weeks or test in the last 72 hours, from 6 May one should not only be allowed to go to the hairdresser and other less essential businesses, but also to museums, theatres, cinemas and restaurants.
Sweden is following a very similar timetable. Sweden's Minister for Digital Development Anders Ygeman assured that with a digital vaccination certificate it will be quick and easy to prove a completed vaccination. Most other EU countries have similar programmes in the pipeline.
The UK has a vaccination rate about twice as high as the EU and has announced the next opening step for 17 May. Then pubs and restaurants will be allowed to serve people indoors, cinemas and theatres will be able to open under certain conditions, and citizens will be allowed to meet up to five other people in private rooms. Domestic travel restrictions will fall for England, Scotland, Wales and Northern Ireland at slightly staggered times in May. There have been conflicting reports from the UK government about the introduction of a vaccination card, but most recently a rejection from the UK Minister for Vaccination Nadhim Zahiwi.
In Austria, the GDC is to be launched in several stages. Actually, the digital passport should be introduced from mid-April for everyone who is tested, and the previous paper test slips should be changed to electronic proof via QR code. The aim is to make it easier to check entry tests, for example for body-related services and other sectors, at future opening stages. Finally, according to the plan for the GDC, convalescents and vaccinated persons should also receive this extended digital vaccination pass.

Even though the EU Parliament has now delayed the timetable somewhat in its final vote, the key provisions remain in principle. Improvements in the equality of non-vaccinated persons in the form of free tests in all countries and a limited period of use of the project to one year are demanded. Whether the EU Vaccination Certificate will ultimately be called the "Green Digital Certificate" or the "EU Covid-19 Certificate" is not important. Rather, the question remains whether implementation is feasible before the summer holidays.