Personal data from EU Digital Certificates on COVID
by Mugurel Olariu, RPD protectie date
Measures have been taken at EU level to facilitate the free movement of nationals of EU Member States, with the adoption of EU Regulation 2021/953[1] – published in JOUE L211 / 1 on 22 of 15.06.2021, was adopted as well as for third-country nationals, EU Regulation No 2021/954[2] – published in JOUE L211 / 24 on 28 of 15.06.2021.
According to Article 2 of EU Regulation 2021/953, the definition of “EU digital certificate on COVID” means an interoperable certificate containing information on the status of the holder, in terms of vaccination, test result or cure, issued in the context of COVID-19 pandemic.
Thus, under the definition of the EU Digital Certificate on COVID, there are three specialized certificates, on vaccination, testing or cure, according to Article 3 paragraph (1) of Regulation No. 2021/953, these being specified and regulated in detail in art. 5 – The vaccination certificate, art.6 – The test certificate and art.7 – The cure certificate.
The main features of the Certificate are that it is issued in digital format and / or printed on paper, contains QR code, is free of charge, is published in the national language and in English, is safety and secure and is valid in all EU countries.
Article 10 of the EU Regulation 2021/953 regulates the Protection of personal data, being declared the applicability of the GDPR for these processing of personal data. It is also limited to the purpose of processing … only for the purpose of accessing and verifying the information contained in the certificate in order to facilitate the exercise of the right of free movement within the Union during the COVID-19 pandemic. The duration of processing shall also be limited, stating that … After the end of the period of application of this Regulation, no further processing of data shall take place. The purpose of the processing is limited ... only to verify and confirm the vaccination, test result or cure of the certificate holder. For this purpose, personal data is limited to what is strictly necessary. Personal data accessed pursuant to this paragraph shall not be retained. It also limits the duration of retention, … Personal data processed for the purpose of issuing the said certificates, including for the purpose of issuing a new certificate, are not kept by the issuer for longer than is strictly necessary for the purpose for which purpose and in no case keep after the expiry of the period during which the certificates may be used for the exercise of the right of free movement. The keeping of any list of revoked certificates transmitted between Member States shall be limited to the end of the period of application. They are qualified as operators … Authorities or other designated bodies responsible for issuing the certificates referred to in Article 3 (1) of the Regulation.
The digital certificate is in use from 1 July 2021 to 30 June 2022. Holding a certificate is not a prerequisite for exercising the right to free movement, and it is not a travel document.
On 3 February 2022, the Commission adopted proposals for a Regulation extending those two Regulations for a further period of one year, ie until 30 June 2023. In addition to extending the application of the EU Digital Certificate on COVID, the proposals seek to amend certain provisions. of EU Regulation 2021/953, respectively:
1) An extension of the definition of SARS-CoV-2 testing based on the detection of viral proteins (antigens) to include immunoassays performed in a laboratory setting and not only rapid antigen tests that give results in less than 30 minutes ;
2) An explicit clarification that the vaccination certificates must contain the number of doses administered to the holder, regardless of the Member State in which they were administered, in order to ensure that the total number actually administered is accurately reflected;
3) Inclusion of vaccination certificates issued for a COVID-19 vaccine subject to clinical trials among those certificates that can be accepted by Member States to waive restrictions on free movement; and
4) Correction of a wrong cross-reference in Article 13 (2) of Regulation (EU) 2021/953.
European data protection authorities have issued a Joint Opinion EDPB[3] – EDPS[4] 1/2022 on the extension of the Covid-19 Certificate Regulation[5], with both general and specific comments on Lack a basis for assessing the necessity and proportionality of the proposal[6] and the Changes in Current Fields.
According to the EU Commission Report[7], in addition to the 27 EU Member States, 35 other non-EU countries (and territories) have joined this trust mechanism. The non-EU countries (and territories) that have acceded to the EU digital certificate system on COVID, in alphabetical order, are: Albania, Andorra, Armenia, Benin, Cape Verde, El Salvador, Faroe Islands, Georgia, Israel, Iceland, Jordan, Lebanon, Liechtenstein, Moldova, Monaco, Montenegro, Morocco, New Zealand, Northern Macedonia, Norway, Panama, San Marino, Serbia, Singapore, Switzerland, Taiwan, Thailand, Tunisia, Togo, Turkey, Ukraine, United Arab Emirates, United Kingdom and British Crown Dependent Territories (Jersey, Guernsey and Isle of Man), Uruguay, Vatican City State.
The data of interest regarding the detailed number of EU Digital Certificates on COVID issued until 01.03.2022, were published in the Annex of the Commission report, being mentioned a total number of 1,718,430,857 Certificates. Of these, France stands out with a total number of EU Digital COVID Certificates of 313,366,916, Italy with 252,073,788, the Netherlands with 220,841,972, Denmark with 220,501,966, Germany with 216,483,636, Austria with 126,955,404, Romania being mentioned with a number of 12,405,997.
———————————————————————-
[1] [REGULATION (EU) 2021/953 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 June 2021 on the framework for the release, verification and acceptance interoperable vaccination, testing and cure certificates for COVID-19 (EU digital certificate on COVID) to facilitate free movement during the COVID-19 pandemic (Text with EEA relevance).
[2] (REGULATION (EU) 2021/954 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 June 2021 on framework for the issuance, verification and acceptance of interoperable certificates of vaccination, testing and cure of COVID-19 (EU digital certificate on COVID) for third-country nationals legally residing or legally residing in the territory of the Member States COVID-19 pandemic (Text with EEA relevance).
[3] EDPB – European Data Protection Board.
[4] EDPS – European Data Protection Supervisor.
[5] https: // edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-12022-extension-covid_en
[6] Point 16 of the Joint Opinion states: 16. The EDPB and the EDPS recall that the original proposal for a regulation was not accompanied by an impact assessment. In their comments in Joint Opinion 04/2021 on the Digital Green Certificate, the EDPB and the EDPS emphasized the lack of an impact assessment accompanying the initial proposal and emphasized that such an impact assessment would have provided a basis for the impact of the ongoing measures. as well as the effectiveness of existing less intrusive measures.
[7]https://ec.europa.eu/info/sites/default/files/second_report_of_the_commission_on_the_eu_digital_covid_certificate_regulation_annex.pdf
