The European Commission presented its Digital Green Certificate on 17 March 2021 in a bid to open up travel across the EU. It provides a common framework among EU countries for the issuance and verification of vaccine certificates, test certificates and recovery certificates. But digital and human rights groups are alarmed that the proposal does not prevent surveillance of certificate holders by the issuing authority and may exacerbate inequalities and social exclusion.

The letter signatories are concerned that the system underpinning the certificate could lead to discrimination. The Commission foresees that test results are an acceptable alternative to proof of vaccination in allowing people to travel, but this will only happen if member states make testing financially and geographically accessible. The pass should also be automatically available in both paper and digital format to so that people with no access to smartphones can enjoy the same rights smartphone owners do.

Orsolya Reich senior advocacy officer at the Civil Liberties Union for Europe said: “It would be catastrophic if, in the middle of this pandemic, the authorities made it more difficult for certain socio-economic groups or minorities to have the same freedoms as everyone else. The Digital Green Certificate must be a tool that avoids discrimination at all costs.”

In addition, the signatories fear that uncertainty around the certificate’s architecture could lead to the creation of extensive data records about the movement of people, their religious affiliation and what they do in their spare time, as some EU member states have said they could use the certificate for regulating entry to places of business and worship or sports venues.

Thomas Lohninger executive director at epicenter.works, said: “The Digital Green Certificate should be a tool to protect people’s health, not one that can lead to a surveillance system which tracks where people go and what they do in their spare time. There need to be safeguards put in place to make sure that the authorities can’t abuse the certificate’s reach. The certificate should be designed so that it adheres to the principle of privacy by design.”

The regulations must clarify that only an offline verification via a public key infrastructure adheres to the principles of privacy by design. That way, when a certificate is verified, the issuer should not obtain knowledge about the verification process or its circumstances. The regulation should also clarify that any further use of the certificate’s system is either prohibited or need to be approved by national legislation, accompanied by a data protection assessment.

Read the letter sent to MEPs here.

The full list of signatories is:

Civil Liberties Union for Europe (Liberties), International

epicenter.works, International

Defend Democracy, International

The Irish Council for Civil Liberties

Peace Institute, Slovenia

Human Rights Monitoring Institute, Lithuania

Rights International Spain

Solidarisches Salzburg, Austria

Verband Freier Rundfunk Österreich, Austria

Hungarian Civil Liberties Union

Aktive Arbeitslose, Austria

Legal-Informational Centre for NGOs, Slovenia

Civil Rights Defenders, Norway

Citizen D, Slovenia

IT-Pol Denmark

Begegnungszentrum für aktive Gewaltlosigkeit, Austria

Homo Digitalis, Greece

Privacy International

Dutch section of the International Commission of Jurists

Verein Respekt.net, Austria

Verein Gegen Tierfabriken, Austria

Elektronisk Forpost Norge, Norway

Bulgarian Helsinki Committee

Vrijschrift, The Netherlands

Access Now, International

Statewatch, International

European Digital Rigts (EDRi)

Panoptykon Foundation, Poland

Previously on Liberties

The 'Digital Green Pass': Is It Safe and Inclusive?

Three Reasons Why A Vaccine Passport Is a Bad Idea

Three Ways The EU Could Prevent Vaccine Roll-Out Creating Two-Tier Societies