As the availability and administration of COVID-19 vaccines continue to increase, so does the support for digital vaccine passport programs. A vaccine passport provides documentation showing that a person has been vaccinated against COVID-19 or recently tested negative for the virus.
The implementation of a COVID-19 vaccine passport could play a key role in the world returning to some degree of normalcy, as it will facilitate safer and more widespread travel and access to otherwise locked down services.
While vaccine passports are not a new concept, there has been significant support for making COVID-19 vaccination passports digital—a format that raises questions about privacy and data protection given the potentially sensitive health data involved.
But what information will be collected by these digital vaccine passport programs? Different programs implemented throughout the world are likely to request varying degrees of information, but the most likely information collected will include an individual’s name, birthdate, date of issuance and type of vaccine received, and/or COVID-19 testing information. In addition to this information, concerns have been raised about the collection and storage of location and other sensitive health information, such as underlying medical conditions.
A common theme in the discussion of privacy and data protection concerns—balancing such concerns with the need for safety—is an important consideration for digital vaccine passport programs. The dangers of COVID-19 are well known, and the possibility of individuals misrepresenting their vaccination or testing status to gain access to otherwise restricted services could have deadly consequences.
Recently, the state of New York launched a mobile phone application, or app, that will allow individuals to show their COVID-19 testing or vaccination status. New York worked with IBM on the implementation of this app, known as the New York State Excelsior Pass program, and it utilizes blockchain technology.
The state of New York represents that the program is voluntary and that it utilizes QR codes to verify name, date of birth, and vaccination or test status, and does not use location services on mobile devices.
As the use of more digital passport programs increases, it will be important to monitor the impact on privacy and data security.