The Ada Lovelace Institute has been exploring the development of public health identity systems in response to the COVID-19 crisis. ‘Public health identities’ (PHIs) are systems for verifiably sharing private health data relevant to public health concerns. These can come in a number of forms, including a health status app or digital immunity certificate, which could be used to stream society based on an individual’s health or risk of COVID-19 infection or transmission.
Different forms of public health identity systems and governance of those systems are emerging around the world. This page seeks to outline what we know so far and will be updated on a regular basis.
This page is current as of 22 September 2020. Please get in touch if you are aware of any updates please let us know by contacting researcher, Elliot Jones via email@example.com.
World Health Organisation
As of 24 April 2020, the World Health Organisation have cautioned the use of immunity certificates, issuing a scientific brief on the subject. The brief states that: ‘At this point in the pandemic, there is not enough evidence about the effectiveness of antibody-mediated immunity to guarantee the accuracy of an “immunity passport” or “risk-free certificate.” People who assume that they are immune to a second infection because they have received a positive test result may ignore public health advice. The use of such certificates may therefore increase the risks of continued transmission.’
Brunei’s contact tracing app, BruHealth, includes a colour coded health status system based on symptom reporting, travel history, contacts and PCR test results, and shared by QR code. Only those with a green or yellow code can enter businesses or participate in certain activities, and only those with a green code can enter mosques and other places of worship.
Chile had a planned immunity certification but changed course. Instead, it has created a “release certificate” to any person who has completed quarantine following a positive for coronavirus on a standard polymerase chain reaction (PCR) test that lasts for three months. The way it is currently being used does not affect a person’s rights regarding lockdown or facemasks. The intention, rather, is to offer more confidence about caring for vulnerable groups.
In China, the Alipay Health Code app assigns users a QR code with a colour – green, yellow or red – based on their health status and travel history. The code can be scanned by authorities.
In Estonia, MTÜ Back To Work are already running a pilot of an immunity passport system developed by Transferwise and Guardtime. The project appears to be related to an earlier effort called CovClear and they are publishing their source code openly.
The pilot is being run with local private firms including A&T Sport, Radisson Blu Sky Hotel Tallinn and PR Foods allowing staff to be tested and share their test results via QR code. The pilot was expected to run until June 2020, but as of July, Back To Work has not published findings from the pilot.
The current system operates via mobile and web application and aims to manage information about COVID-19 tests(either PCR tests or antibody tests)and medical certificates issued by a medical professional. They hope to also include vaccine information in the system once effective vaccines are available.
After logging in and authenticating via their state-issued Estonian ID, the user can get information about their test results from a database. They can then share that information via a QR code. The QR code expires after a minute and access to data from that code after an hour.
The current system is framed as a proof-of-concept pilot of a potential immunity certification system to test how it might work technically before scientific questions of immunity presence, duration and detection are resolved.
The pilot has six phases:
- Informing companies and employees about the nature of the pilot project
- Reaching agreement on the scope of testing and logistics between the companies participating in the pilot project and the occupational health partner participating in the Immunity Passport pilot project
- Taking COVID-19 and/or antibody tests from staff who have given their consent
- Entering test results in the Immunity Passport application
- Showing test results to employer
- Gathering feedback and drawing conclusions
They don’t address the social consequences of creating such a tool, regardless of its efficacy. “We believe that the Immunity Passport is a tool to instil peace and order in the current understanding of COVID-19 and to allow infected people to return to normal working and social life more quickly. Uncertainty creates unnecessary fear and possible discrimination.” – Taavet Hinrikus
On 10 August 2020, the president of El Salvador, Nayib Bukele, announced the country was planning to issue immunity passports to people who have recovered from COVID-19, allowing them to be employed by the government and giving them social privileges not enjoyed by the rest of the population. The government stated it will employ such people to distribute medical kits and food aid to households affected by the pandemic.
Health Commissioner, Stella Kyriakides, stated on the 25 May 2020, that ‘the EU can’t count on immunity certification when lifting border restrictions within the bloc‘ and subsequently on 26 May, the European Centre for Disease Prevention and Control (ECDC) in its report on travel-related measures to reduce the spread of COVID-19 stated that ‘given the evidence currently available, any immunity certification for COVID-19 is not supported by ECDC.’ The Health Commissioner has responded in the same vein to multiple questions from MEPs on the topic over the summer of 2020.
Marc Angel, S&D MEP for Luxembourg, asked the European Commission questions on immunity passports on 4 May 2020:
- Does the Commission support the idea of issuing ‘immunity passports’ as a measure in the fight against the COVID-19 pandemic?
- If so, how does the Commission intend to ensure that such certificates would not in future become a condition or advantage for employment, and that employers will not refer to employee health records when making hiring or firing decisions?
On 29 May 2020, Elżbieta Rafalska and Beata Szydło ECR MEPs for Poland, asked:
- How does the Commission view the idea of immunity certificates or mentioning having had COVID-19 in documents such as CVs, and does it see a risk in this of discrimination, with a distinction being drawn between those who have already acquired immunity and those who have not?
- Does the Commission recognise the risk of creating a two-tier society, in which people who have recovered from COVID-19 could enjoy all kinds of freedoms, while those who have followed instructions but not yet fallen ill would not have those same freedoms?
On 26 June 2020, ECR MEP for Poland, Joanna Kopcińska also asked about immunity passports:
- What is the Commission’s stance on the matter of the ‘immunity passport’? Does the Commission have a definition and an understanding of the role of an ‘immune passport’?
- Are there any recommendations that the European Commission could take into account in the context of the role that the ‘immune passport’ could play in a future potential second wave of the pandemic?
On 10 July 2020, Health Commissioner Kyriakides first responded to Marc Angel, saying:
- The Commission is aware that some countries are considering the use of so-called ‘immunity passports’ or ‘health passports’ as part of the lifting of confinement measures.
- However, the European Centre for Disease Prevention and Control (ECDC) advises that there is currently limited evidence on lasting immunity. In its Risk Assessment of 11 June 2020, the ECDC states that most persons infected with coronavirus develop antibodies after infection. However, the longevity of the antibody response is still unclear. The quantity, quality and duration of the human immune response to COVID-19 is presently unclear.
- As a consequence, there is not enough scientific basis for using serology or other immune markers to determine access to public facilities, or take decisions on travel or employment. The World Health Organisation has also cautioned against using immunity certificates.
- The Commission will continue to explore this issue, always placing scientific evidence as the basis for public health policy. The Commission is also helping Member States to coordinate national responses to the pandemic through the Health Security Committee.
On 26 August 2020, Health Commissioner Kyriakides responded to Joanna Kopcińska, saying essentially the same as she had to Angel, and additionally saying that:
- There is a lack of validated serology tests that can ascertain immunity to the virus.
- The Commission is therefore not considering a role for so-called ‘immunity passports’ in preparation for future outbreaks of the pandemic.
On 9 September 2020, Health Commissioner Kyriakides responded to Elżbieta Rafalska and Beata Szydło, additionally saying:
- As for the mention of COVID-19 immunity in documents, health data are considered as sensitive data under the General Data Protection Regulation (GDPR) and their processing can only take place under strict requirements. One of the legal grounds for processing such personal data is public interest in the area of public health. In such cases, Union law or Member State law shall be necessary and proportionate, and provide specific measures to safeguard the rights and freedoms of the concerned individual.
- Measures restricting fundamental rights must be limited to what is necessary and strictly proportionate. The Commission will continue to monitor such measures until they are all lifted and will be very vigilant on whether they are adequately phased out.
On 29 April 2020, a press release from the German Health Ministry stated it intended to allow people who have recovered from COVID-19 to get an immunity certificate similar to the vaccination card; if immunity post-infection in scientifically proven. This was reflected in the original draft of the “Zweiten Gesetz zum Schutz der Bevölkerung bei einer epidemischen Lage von nationaler Tragweite” legislation.
On 4 May, this was scaled back to the Health Minister, Jens Spahn, asking the German Ethics Council to consider how such an immunity passport could fulfil its aims while respecting people’s rights. Until the Ethics Council have reported, the German Government agreed not to undertake any legal regulations.
On 28 May, the German Ethics Council announced it will prepare an Ad Hoc Recommendation on the introduction of a proof of immunity for COVID-19, to be published before the Bundestag parliament summer break (i.e. 3 July 2020).
However, on 25 June, the Council announced it would devote more time to its statement on immunity certificates, so its recommendation is likely to be delayed, though it has not yet given an indication of the new schedule. Earlier the same day, the SPD’s Bärbel Bas had stated that the SPD do not believe an immunity certificate should be introduced and believe there must be no difference in freedom and personal rights due to antibody status. Leader of the SPD, Saskia Esken, had similarly commented that day that an immunity certificate for COVID-19 is completely unthinkable without scientific proof antibodies grant immunity and the ability to get a certificate without targeted infection.
On 8 July, the Federal Government, in response to questions by the FDP party, stated that the assessment of immunity certificates by the German Ethics Council would be presented in September 2020. It also suggests the Federal Government believes an immunity certificate could be designed in a way compatible with informational self-determination and equality rights laid down in the German Constitution.
On 22 September 2020, the German Ethics Council published their report on immunity certificates. They did not recommend the use of immunity certificates at the time of publication, due to many uncertainties still exists regarding immunity against COVID-19. They recommended that:
- Commercially available tests to detect immunity against SARS-CoV-2 should be more strictly regulated, considering doubts around their reliability and the resulting potential dangers.
- The public should be comprehensively informed about anti-infection measures serving the common good and about the limited scope of antibody tests.
- Further targeted and coordinated research on the infectious and immunological properties of the novel coronavirus.
The Council was split on whether the use of immunity certificates would be ethical in the case where there was robust proof of immunity to COVD-19 and reliable tests to verify that were available. Based on a risk ethics approach, half of the Council believed that if immunity could be verified, the introduction of immunity certificates would be advisable under certain conditions and in a step-by-step process that could at least initially limit their use to specific contexts or areas. Some members argued that more far-reaching applications would also be justifiable. The other half of the Council members reject the use of state-controlled immunity certificates even if uncertainties regarding the knowledge about immunity were resolved in the future for practical, ethical and legal reasons,
Pangea, an Israeli digital ID and border control software firm, has proposed a biometric smart card that will store antigen and antibody test results, to allow passengers to enter and board flights at airports. No country has taken up their proposal, although they claim to be in talks with the Israeli and South African authorities.
They don’t believe their technology should be used by the private sector and instead believe government approval is necessary for implementation. They are actively working towards such a smart card lasting beyond the COVID-19 pandemic to become a general medical passport.
Italy has discussed this at a regional level, with the president of the Veneto region proposing a special license for those with antibodies. Former Prime Minister, Matteo Renzi, has suggested a ‘COVID pass’ for the uninfected.
Polish Minister of Digital Affairs, Marek Zagórski, has told the Polish NGO, Fundacja Panoptykon, that there are no plans for an immunity certificate system in Poland, as of 14 May 2020.
South Korea’s Ministry of Culture, Sports and Tourism is apparently considering proposals from their tourism industry to include immunity passports as part of a wider travel bubble program with nearby countries like Taiwan, Vietnam and Thailand. The travel bubble and immunity passports will be on the agenda at the 6th National Tourism Policy Meeting.
In Spain, the company Vottun, which specialises in the certification and traceability of data on the blockchain, claims to have rolled out a digital health passport with PwC in April.
On 18 June 2020, the Spanish Data Protection Agency warned that asking candidates whether they had developed COVID-19 antibodies as a requirement to take a job constituted a violation of data protection regulations. They stated that information about whether someone has COVID-19 antibodies is personal data related to health. Further, they stated that, under the GDPR, a legal basis is required to lawfully process that information and neither consent of the applicant or necessity for a contract were applicable in this case. They also state that if candidates include information about their antibodies in their application, the recruiting company must delete that information and delete the application if it not possible to make sure that information does not influence the final hiring decision.
The President of the Community of Madrid, Isabel Díaz Ayuso, had asked the Madrid Ministry of Health to develop, by September 2020, an experimental COVID-19 card that uses antibodies, PCR tests, and other proof that an individual has already been infected with, and recovered from, COVID-19 to “simulate an international vaccination card”. She indicated that this card would help to avoid confinements, to safely access establishments such as gyms, museums, cinemas, and, in general, any closed room. Within a day, this scheme had faced sufficient criticism from other politicians, epidemiologists, and rights groups that Madrid abandoned the scheme.
Switzerland’s Federal Office for Public Health says the introduction of COVID-19 immunity passports is not on the agenda for now (as of 14 May 2020). However, they have said that ‘provided that we have confirmation that the antibodies do indeed lead to long-term immunity, it could make sense. It will also become relevant as soon as a vaccine is developed.’
The Swiss National COVID-19 Science Task Force, a national scientific advisory board with a mandate from the Swiss Federal Council Coronavirus Crisis Unit and Federal Office of Public Health, on 22 April 2020, stated that ‘as long as scientific uncertainty in identifying immunity and its duration persists, such [immunity] passports should not be used as they restrict human rights, create societal dangers, and cannot be justified by a legitimate public interest.’
SICPA, a Swiss company, and Guardtime, an Estonian company now based in Switzerland, have proposed using blockchain and a QR code to associate the result of a test with a specific individual, without assuring anything about the quality or meaning of the test itself.
United Arab Emirates
The United Arab Emirates’ contact tracing app, Alhosn, includes a colour coded health status system based on PCR test results and shared by QR code. They state that ‘You may need to use this unique QR code to grant you access to public places in the future.’
The UK Government is considering immunity certification and possibly wider health status tracking. Baroness Harding, who is leading the Government’s testing and tracing effort, also has Immunity Certification explicitly within her remit. Public Health England’s draft contact tracing operating model, as of 23 April 2020, explicitly identified immunity risk certification as the sixth pillar of the UK Government’s contact tracing plan.
Lord Bethell, Minister for Innovation at the Department for Health and Social Care, has also stated that ‘[the Government’s immunity certificate plans] are in development. We are fully aware of the concerns that he has expressed about their potentially divisive nature, but the public deserve to know whether they have had the disease. We have to use whatever technology we can to help shake off the economic and social effects of this virus. Therefore, we retain an open mind on the use of certification.’
Greg Smith, Conservative MP, on 24 July 2020, asked the Secretary of State for Health and Social Care ‘what plans he has to introduce immunity passports as a means of allowing the public to safely (a) take flights and (b) attend the theatre?’
Minister of State, Nadine Dorries, replied that ‘before considering whether antibody testing and certification could ever be used to enable specific individuals to be exempted from social distancing restrictions and/or self-isolation measures, we first need to improve our understanding of how the immune system responds to COVID-19.
To gain answers to these critical questions on immunity, the United Kingdom Government has been working closely with the Office for National Statistics, Biobank, universities and other partners to establish a series of studies that will help us learn more about the prevalence and spread of the virus, as well as the nature and duration of the immune response.’
NHSX CEO, Matt Gould, has told the Commons Science and Technology Committee that he’d been approached by a number of organisations about providing immunity passport technology, but said NHSX was in ‘the very early stages’ of looking through the available options and that they ‘are not at a point where [they] are building [immunity passports].’
‘Health status’ was reported to be under consideration as a future element of the NHSX Contact Tracing App. NHSX has since discontinued that app in favour of an app developed using Google and Apple’s exposure notification API and it is unclear whether a ‘health status’ is planned to be integrated into the new app.
According to the minutes of the 40th Scientific Advisory Group for Emergencies (SAGE) meeting held on 4 June 2020, SAGE suggested that ‘uncertainties around the implications of antibody test results mean that clinical use of serological testing is some way off. Immunity passports or equivalents are not advisable for similar reasons’. In the 41st SAGE meeting, on 11 June, the SAGE Secretariat stated it would ‘commission [an] item of double testing and release, quarantine and antibodies…’ for the next SAGE meeting.
A paper produced for the 45th SAGE meeting – Tests for antibodies against SARS CoV2 by Wendy Barclay and Peter Openshaw, concluded that ‘if immunity passports based on the commercial antibody tests change behaviour, or practise, the low specificity [of commercial antibody tests] could have serious implications. At present, there is insufficient evidence that knowledge of an individual’s immune status can be relied upon to enable a change in behaviour. This is because the tests themselves have lower than ideal specificity, and we do not yet know that a positive result in such a test guarantees protective immunity.’ SAGE advised that, based on current understanding, it would be premature to introduce immunity passports, but advised that use of antibody positivity for short-term decisions may be possible.
On 9 July 2020, at the 46th SAGE meeting, ‘SAGE noted that the conclusion of the Senior Clinicians Group that, at present, a testing strategy that includes antibody testing, swab testing and Ct value assessment to enable release of individuals from self-isolation or quarantine cannot be operationalised – and that further data are needed before an optimal strategy can be designed.’
London Heathrow Chief Executive, John Holland-Kaye, has advocated for a universal system of immunity certification, which would allow for people who have already had coronavirus to travel between ‘low risk’ countries.
IDnow, a German identity verification company, has claimed it has been in talks with the UK Government about a system to identify people who had recovered from COVID-19, though the Government set no timeline for the project.
Onfido, a British biometric and digital identification company, has also submitted a proposal for an immunity passport to the UK Government.
Yoti, a British digital identity management company, has established a partnership with a Polish testing company, FRANKD, to store and share credentials verifying the outcome of COVID-19 tests – either antigen or antibody tests.
YourGene, a diagnostics company, and Prova, a start-up focused on sharing test results, are planning to offer a COVID-19 health status app to employees and clients of foreign exchange provider Caxton.
Dr Anthony Fauci, Director of the National Institute of Allergy and Infectious Diseases, has said immunity certificates are ‘being discussed’.
New York State Assembly members have proposed Bill NOA10462 as legislation to govern the use of COVID-19 contact tracing and immunity certification. The Bill aims to ‘establish a protocol for COVID-19 testing, contact tracing, and Immunity Certification and to protect individuals’ right to privacy; grants individuals the right to control their self-sovereign identification data; provides for the anonymization of biometric data for protection from law enforcement.’
The US Department of Defense’s Naval Medical Research Center has been studying how to mitigate the effect on marine operations, including testing the viability on an ‘immunity passport’ for marines by identifying ‘a measurable indicator that can be calculated to safely return recruits and Marines back to the fight even if they are re-exposed to the infection.’
Judy Faulkner, CEO of Epic Systems, a major medical records company, has said Epic is working with a group to put a marker related to antibody testing on your phone. The marker will likely be an extension of their MyChart patient medical record access application, and will likely say whether you are tested, whether you are currently not safe, and whether you have COVID-19 right now. This would likely be setup as a traffic light style code with red for currently infected, green for clear, and yellow for unknown.
The California facial recognition start-up, FaceFirst, has been promoting the idea of a ‘coronavirus immunity registry.’ They explicitly frame it as a way to inform employers and border control officials about an individual’s COVID-19 status. They want to include test results, what kind of test was administered (whether antigen or antibody), and whether you have been near confirmed infections. They claim to be in ‘indirect discussions’ with the US Government.
On 23 July 2020, NHL (National Hockey League) announced that it would be using Clear’s (an air travel security platform) Health Pass to screen players and staff during their playoffs. According to the company, the system will help track about 3,000 people who are involved, including players, coaches, and support staff. After registering their identity within Clear’s biometric system, those involved in the playoffs will be expected to fill out a regular health survey after leaving hotel rooms, take a selfie with their phone to confirm their identity, and then use a QR code to register their information at the kiosk and have their temperature taken in order to enter the NHL’s secured areas. The Clear website also suggests lab test results can be linked to the system and suggest that vaccine status and more will be integrated into the system over time.
Onfido, a global identity verification and authentication company, are developing immunity passport integration for start-up Sidehide’s hotel booking platform.
Bizagi, a UK-based company, has created CoronaPass, an app which claims it will use an encrypted database to store information about users’ immune status, based on antibody test results provided by the user’s hospital or another healthcare provider. They want to leave the criteria for what counts as a valid test, who is seen as ‘immune’ and how long certificates should last, up to individual governments and health authorities. They claim to be trailing the app with Ernst & Young for their employees and clients.
The International Air Transport Association, a trade body representing 290 airlines which make up 82% of global air traffic, has said it would support the development of immunity passports to segregate no-risk travellers, when these are backed by medical science and recognized by governments.
Tracking public and private applications of public health identity systems and collating and monitoring as details emerge into the public domain.
As the building of technical capacity for immunity apps and deliberation about deployment progresses, we surface six issues policymakers must consider
New forms of technology are coming. How do we ensure they’re deployed in a way that conforms to equality regulation?
A resource for monitoring the development, uptake and efficacy of global attempts to utilise smartphones and other digital devices for contact tracing