Vaccine Passports: What Are the Implications?

The purpose of a vaccine passport is to allow governments and private businesses to confirm to what degree a person may be at risk of contracting COVID-19 or spreading it to others around them. In its most basic form, a vaccine passport is a (usually) digital record that confirms whether its bearer has received two, one or no doses of a COVID-19 vaccine. This is the model that the UK’s NHS COVID Pass uses. The EU Digital COVID Certificate (EUDCC) goes a step further by also containing information about its bearers’ recent test results and recovery status from COVID-19.

The EUDCC was implemented on 1 July, allowing carriers – who are either fully vaccinated, have contracted and recovered from COVID-19, or have tested negative for the virus within the past day – to use a digital or printed QR code to travel freely among the EU’s 27 member states. Some of these members have instated their own digital certificates for use within their borders, such as France’s health passport that regulates entry to clubs and (soon) bars, cafes and restaurants.

As of the time of writing, the US has no plans to implement a similar system at the national level, with individual states left to determine whether (and how) they will provide residents with a method of accessing state-verified health records. Meanwhile, the NHS COVID Pass remains an opt-in measure for businesses in the UK, though Prime Minister Boris Johnson has stated an intention to “to make full vaccination the condition of entry to nightclubs and other venues where large crowds gather” by the end of September, necessitating its uptake by the general public.

There are few historical precedents for such large-scale monitoring of a health condition. What legal complications will need to be considered in relation to this drastic measure? We spoke with a range of legal experts to get a sense of what might lie ahead.

There are few historical precedents for such large-scale monitoring of a health condition.

Human Rights

As far as the UK goes, one of the most significant pieces of legislation that vaccine passports must contend with is the Human Rights Act 1988. Article 8 of the Act guarantees the right to a “private and family life”, which is interpreted broadly to include personal identity. As John Szepietowski of Audley Chaucer Solicitors points out, this could be said to extend to one’s medical status as well, though this right may be suspended “in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

Key to the issue here is whether or not the use of vaccine passports is proportionate to the crisis at hand. While necessarily restricting some movement, this would be limited only to specific venues and would not prevent other meetings or social interactions more broadly. By virtue of being so limited in scope, Szepietowski argues, the passports are unlikely to infringe upon Article 8. Other notable Articles of the Act – such as Article 2’s “right to life” or Article 5’s “right to liberty” – may be pertinent to the question of mandatory vaccination, but are sufficiently separated from the issue of passports as to pose little concern in this area.

Discrimination

A key factor that has delayed widespread implementation of vaccine passports has been its lack of availability to younger, less vulnerable adults as vaccinations for the more at-risk have been prioritised. As Szepietowski notes, the creation of a system that tacitly restricts freedoms based on age raises the possibility of discrimination.

“Beyond this, however, there could still be age discrimination because more young people are concerned about the long-term impact of the jab,” Szepietowski continues. “This links to gender discrimination as well, as more women than men have concerns about fertility and the vaccine, and so are less likely to take the vaccine. Likewise, those from Black or Minority Ethnic backgrounds are less statistically less keen on the jab, and so passports could be seen to discriminate against them as well.”

This situation for young people has begun to shift, as all adults in the UK have now been given the opportunity to receive two vaccinations (though not all have yet been able to attend their appointments), but issues of discrimination in other areas, such as race, have risen to the fore. The EUDCC has already come under fire from the African Union for not recognising the Indian Covishield vaccine, which has been distributed to many low- and middle-income countries through the EU-supported COVAX programme, and vaccine uptake among ethnic minorities remains proportionately low.

As age and race are classed as protected characteristics under the Equality Act, there may be a legal basis to claim discrimination here. However, a strong counterpoint exists in the vaccines’ availability to all, with no need to bring an ID or any more personal information to a walk-in vaccination centre other than a name, address and date of birth. Once vaccine rollout programmes in the UK and elsewhere begin to wind down, the state of being unvaccinated is far more likely to come down to personal choice than an act of discrimination against a protected group of people.

Security

Perhaps the biggest challenge standing in the way of widespread vaccine passport implementation is the security risk represented by the data that the passports would be based upon. Any kind of medical data is already valuable due to its personal nature, and its sensitivity only increases when it is relied upon for travel and access to local facilities.

A particular concern raised by Tim Mackey, principal security strategist at the Synopsys Cybersecurity Research Centre, is that of third-party apps – whose use has become widespread in Europe as part of accessing the EUDCC – and the possibility of a bug or an outside attacker disrupting their function. This point ties in with the need to ensure that a digital passport’s authenticity in the first place.

Any kind of medical data is already valuable due to its personal nature, and its sensitivity only increases when it is relied upon for travel and access to local facilities.

“Significant coordination between international entities is required to ensure that the data recorded by the app is correct and complete,” Mackey explains, noting that the act of safely transferring data to the app would be its own challenge. “Once in the app, the data needs to be verifiably secure and stored in a tamper-evident form that itself can’t be modified.

Balfour+Manson chairman Elaine Motion raises further questions regarding how the information pertinent to vaccine passports will be handled by the private sector: “For example, if shown to nightclub personnel, do they store the information and if so how, for how long and who can access that information?” The question of how long a government organisation might retain the data is also unclear. Whatever the case, the implementation of a passport requirement for travel and domestic activity will require intense scrutiny to ensure that the sensitive information at its base is not mishandled.

Employment

Potential employment-related issues with the passport system largely intersect with concerns about discrimination based on vaccination status. While most offices have adopted a vaccine-positive mentality, and “no jab no job” policies have been instituted in many areas, a small percentage of the workforce who have voiced opposition to being compelled to be vaccinated will likely oppose the requirement of a passport to verify their medical history as a prerequisite for work. If these employees also belong to a protected group, disciplinary action against them may result in a discrimination claim. The same issue may arise if it is perceived that employees are treated differently based on their vaccination status.

In cases where employees are expected to work with those most vulnerable to COVID, of course, the situation may be different. From October, anyone working in a CQC-registered care home in England for residents requiring nursing or personal care will be required by law to have received two doses of a COVID-19 vaccine unless they are subject to a medical exemption. If any other professions should receive this treatment, however, they are likely to only make up a fraction of the overall UK workforce, however.

A small percentage of the workforce who have voiced opposition to being compelled to be vaccinated will likely oppose the requirement of a passport to verify their medical history as a prerequisite for work.

Furthermore, Katten Muchin Rosenman partner Christopher Hitchins points out that employers would need to comply with GDPR when storing this information, sparking its own host of pitfalls. “According to the UK data protection regulator (the ICO), the reason for recording your employees’ vaccination status must be clear and compelling,” Hitchins notes. “If you have no specified use for this information and are recording it on a ‘just in case’ basis, or if the employer can achieve their goal without collecting this data, they are unlikely to be able to justify collecting it.”

A company that mandates a vaccine passport would therefore do well to ensure that its need is genuine and take all due care to avoid altering its treatment of employees based on their COVID-19 records.

The Outcome

Perhaps the only certain result of the widespread rollout of vaccine passports is the strain that it will place on the affected industries. The travel, hospitality and leisure sectors, already hampered by a year and a half of slackened demand and heightened regulation, will be further pressed by the responsibility to validate these passports and handle situations with customers who feel they ought to be exempt.

Lucy Gordon, Director of the Employment team at Walker Morris, stresses that the added pressure may be too much for struggling businesses to handle. She states: “Employers will need to allocate resources to checking passes, and train staff on what to look out for and how to handle difficult cases. This all comes at a time when the hospitality industry is already strained and suffering additional resource issues due to the “pingdemic”, with staff being forced to isolate or having to stay at home to look after family members.”

It is also unknown for how long the vaccine passport system will last – likely until the WHO declares the pandemic finished, whenever that may be. Until then, we will watch with close interest as the situation develops in the UK and internationally.