The rapid development and roll-out of vaccines to protect people from COVID-19 has prompted debate about digital ‘vaccine passports’. There is a confusion of different terms to describe these tools, which are also called COVID-19 status certificates. We identify them through the common properties of linking health status (vaccine status and/or test results) with verification of identity, for the purpose of determining permissions, rights or freedoms (such as access to travel, leisure or work). The vaccine passports under debate primarily take a digital form.
Digital vaccine passports are novel technologies, built on uncertain and evolving science. By creating infrastructure for segregation and risk scoring at an individual level, and enabling third-parties to access health information, they bring profound risks to individual rights and concepts of equity in society.
As the pandemic death toll rises globally, some countries are bringing down case numbers through rapid vaccination programmes, while others are facing substantial third or fourth waves of infection, and the mitigating effects of vaccination have brought COVID vaccine passports into consideration for companies, states and countries.
Arguments offered in support of vaccine passports include that they could allow countries to reopen more safely, let those at lower risk of infection and transmission help to restart local economies, and allow people to reengage in social contact with reduced risk and anxiety.
Could a digital vaccine passport provide a progressive return to a normal life, for those who meet the criteria now, while vaccines are distributed in the coming months and years? Or might the local and global inequalities and risks outweigh the benefits and undermine societal notions of solidarity?
Checkpoints for vaccine passports
This is the executive summary of a report presenting the key debates, evidence and common questions around digital vaccine passports
The current vaccine passport debate is complex, encompassing a range of different proposed design choices, uses and contexts, as well as posing high-level and generalised trade-offs, which are impossible to quantify given the current evidence base, or false choices that obstruct understanding (e.g. ‘saving lives vs privacy’). Meanwhile, policymakers supporting these strategies, and companies developing and marketing these technological solutions, make a compelling and simplistic pitch that these tools can help societies open up safer and sooner.
This study disentangles those debates to identity the important issues, outstanding questions and tests that any government should consider in weighing whether to permit this type of tool to be used within society. It aims to support governments and developers to work through the necessary steps to examine the evidence available, understand the design choices and the societal impacts, and assess whether a roll-out of vaccine passports could navigate risks to play a socially beneficial role.
This report is the result of an international call for evidence, an expert deliberation, and months of monitoring the debate and development of COVID status certification and vaccine passport systems around the world. We have reviewed evidence and discussion on technical build, risks, concerns and opportunities put forward by governments, supranational bodies, collectives, companies, developers, experts and third-sector organisations. We are indebted to the many experts who brought their knowledge and evidence to this project (see full acknowledgements at the end of this report).
Responding to the policy environment, and the real-world decisions being made at pace, this study has, of necessity, prioritised speed over geographic completeness. In particular, we should caution that the evidence submitted is weighted towards the UK, Europe and North American contexts and will be more useful currently to policymakers in these areas, and in future to policymakers facing similar conditions – increased levels of vaccination and reducing case numbers – while navigating what are likely to be long-term questions of managing outbreaks and variants.
There are some factors for consideration that will be relevant to any conditions, for countries and states considering whether and how to use digital vaccine passports. These include the exploration of the current evidence on infection and transmission of the virus following vaccination, and some aspects of the technical design considerations and choices that any scheme will face.
A number of the issues – such as the standards governing technical development – will need to be considered at an international level, to ensure interoperability and mutual recognition between different countries. There are strong reasons why all countries should consider the potential global impacts of adoption of a vaccine passport scheme. Any national or regional use of vaccine passports that contributes to hoarding or ‘vaccine nationalism’ will produce extreme local manifestations of existing global inequalities – both in terms of health and economics – as the high rate of infection and deaths in India currently evidences. Prioritising national safety over global responsibility also risks prolonging the pandemic for everyone by leaving the door open to mutations that aren’t well controlled by existing vaccines.
Other requirements will be highly contextualised in each jurisdiction. The progress in accessing and administering vaccinations, local levels of uptake and reasons for vaccine hesitancy, legal regimes, and ethical and social considerations will weigh heavily on whether and how such schemes should go ahead. Even countries that seem to have superficially similar conditions may in fact differ on important and relevant aspects that will need local deliberation of what is justifiable and achievable practically, from the extent of existing digital infrastructure to public comfort with the use of technology, and attitudes towards increased visibility to the state or to private companies.
Incentives and overheads will look different as well. The structure of the economy – whether it is highly reliant on tourism for example, as well as the level of access to the internet and smartphones – will be important factors in calculating marginal costs and benefits of digital vaccine passports. And that local calculation will need to be dynamic: countries with minimal public health restrictions in place and low rates of COVID-19 face very different calculations in terms of benefits and costs to those in highly restrictive lockdowns with a high rate of COVID-19 in the community.
This report presents the key debates, evidence and common questions under six subject headings. These are further distilled in this summary into six requirements that governments and developers will need to deliver, to ensure any vaccine passport scheme builds from a secure scientific foundation, understands the full context of its specific sociotechnical system, and mitigates some of the biggest risks and harms through law and policy. In other words, a roadmap for a vaccine passport system that delivers societal benefit. These are:
- Scientific confidence in the impact on public health
- Clear, specific and delimited purpose
- Ethical consideration and clear legal guidance about permitted and restricted uses, and mechanisms to support rights and redress, and to tackle illegal use
- Sociotechnical system design, including operational infrastructure
- Public legitimacy
- Protection against future risks and mitigation strategies for global
These requirements (with detailed recommendations below) set a series of high thresholds for vaccine passports being developed, deployed and implemented in a societally beneficial way. Building digital infrastructure in which different actors across society control rights or freedoms on the basis of individual health status, and all the myriad of potential benefits and harms that could arise from doing so, should face a high bar.
At this stage in the pandemic, there hasn’t been an opportunity for real-world models to work comprehensively through these challenging but necessary steps, and much of the debate has focused on a smaller subset of these requirements – in particular technical design and public acceptability. Despite the high thresholds, and given what is at stake and how much is still uncertain about the pathway of the pandemic, it is possible that the case can be made for vaccine passports to become a legitimate tool to manage COVID-19 at a domestic, national scale, as well as supporting safer international travel.
As evidence, explanation and clarification of a complex policy area, we hope this report helps all actors navigate the necessary decision-making prior to adoption and use of vaccine passports. By setting out the features to be delivered across the whole system, the benefits and risks to be weighed, and the harms to be mitigated, we hope to support governments to calculate whether they can be justified, or whether investment in vaccine passports might prove to be a technological distraction from the central goal to reopen societies safely and equitably: global vaccination.
Recommendations summary for governments and developers
1. Scientific confidence in the impact on public health
The timeframe of the pandemic means that – despite significant leaps forward in understanding that have led to more effective disease control and vaccine development –scientific knowledge is still developing about the effectiveness of protection offered through tests, vaccines or antibodies that most vaccine passport models rely on.
Most of the vaccines now available offer a high level of protection against serious illness from the currently dominant strains of the virus. It is still too early to know the level of protection offered by individual vaccines in terms of duration, generalisability, efficacy regarding mutations and protection against transmission.
This means that any vaccine passport system would need to be dynamic, taking into account the differing efficacy of each vaccine, known differences in efficacy against circulating variants, and the change in efficacy over time. A vaccine passport should not be seen as a ‘safe’ pass or a proxy for immunity, rather as a lowering of risk that might be comparable to, or work in combination with, other public health measures.
Calculating an individual’s risk based on providing test results within a vaccine passport scheme avoids some of the problems associated with relying solely on vaccination, including access, take-up and coverage. A good negative test indicates that an individual is not currently infectious and therefore not a risk to others. However, this type of hybrid scheme requires widespread access to highly accurate and fast turnaround tests, as well as scientific consensus as to the window in which someone can be deemed low risk (most use 24–72 hours).
Evidence of a negative test offers no ‘future’ protection after that window, making it less desirable for a move to another city or entry to another country. Given that most point-of-care tests (tests that give a result at home) have a lower level of accuracy than tests administered in clinical settings, the practical overheads of reliance on testing may make this highly challenging for any routine or widespread use. If consistently accurate point-of-care tests become available, that might make testing a more viable route for a passport system, but would also reduce the need for a digital record – as people could simply show the test at the point of access.
Almost all models of vaccine passport attempt to manage risk at an individual level rather than using collective and contextual measures: they class an individual as lower risk based on their vaccine or test status, rather than a more contextual risk of local infection numbers and R rate in a given area. Prioritising this narrow calculation above a more contextual one may undermine collective assessments of risk and safety, and reduce the likelihood of observing social distancing or mask wearing.
A further important dimension is how the use of a vaccine passport affects vaccine take-up by hesitant groups – it provides a clear incentive to disengaged or busy people, but could heighten anxiety from those who distrust the vaccine or the state, if it is seen as mandatory vaccination or surveillance by the back door.
Before progressing further with plans for vaccine passports:
Governments and public health experts should:
- Set scientific pre-conditions, including the level of reduced transmission from vaccination that would be acceptable to permit their use; and acceptable testing regimes (accuracy levels and timeline).
- Model and test behavioural impacts of different passport schemes (for
example, in combination or in place of social distancing). This should examine
any ‘side effects’ of certification (such as a false sense of security, or impacts
on vaccine hesitancy), as well as responses to changing conditions (for
example, vaccines’ efficacy against new mutations). This should be modelled
in general and in specific situations (such as the predicted health impact if
used in place of quarantine at borders, or social distancing in restaurants), to
inform their likely real-world impact on risk and transmission.
- Compare vaccine passport schemes to other public health measures in
terms of necessity, benefits, risks and costs, or alternatives – for example,
offering different guidance to vaccinated and non-vaccinated populations
without requiring certification; investing in public health measures; or greater
incentives to test and self-isolate.
- Develop and test public communications about what certification should be
understood to mean in terms of uncertainty and risk.
- Outline the permitted pathways for calculating what constitutes ‘lower risk’ individuals, to build into any ‘passport’ scheme, including: vaccine type; vaccination schedule (gaps between doses); test types (at home or professionally administered); natural immunity/antibody protection; and duration of reduced risk following vaccination, testing and infection.
- Outline public health infrastructure requirements for successful use of a passport scheme, which might include access to vaccine, vaccination rate, access to tests, testing accuracy, or testing turnaround.
- Recognise, understand and use the science underpinning these systems.
- Use evidence-based terminology to avoid incorrect or misleading understanding of their products. For example, many developers conflated the concept of ‘immunity’ with ‘vaccinated’ in materials shared with partners and governments, creating a false sense that these systems can prove if someone is immune.
- Follow government guidelines for permitted pathways to calculation of ‘lower risk’.
- Not release for public use any digital vaccine passport tools for use until there is scientific. agreement about how they represent ‘lower risk’ (as above).
2. Clear, specific and delimited purpose
It will be much easier to weigh the benefits, risks and potential mitigations when considering specific use cases (visiting care homes, starting university, or international travel without quarantine, for example) rather than generalised uses.
Based on the health modelling, there may be greater justification for some use cases of digital vaccine passports than others, such as settings where individuals work face to face with vulnerable groups. Countries are already coming under pressure to create certificates for international travel to selected destinations and this is likely to expand. There may also
be some uses that should be prohibited as discriminatory (examples to consider include accessing essential services, public transport or voting) and exemptions that should be introduced for those unable to have a vaccine or regular testing.
Developing clear purposes and uses should be carried out with consideration to public deliberation, and law and ethics (see below), and mindful of risks that could be caused in different settings, which might include liability for businesses or insurance costs for individuals, barriers to employment, as well as stigma and discrimination.
Before progressing further with plans for vaccine passports:
- Specify the purpose of a vaccine passport and articulate the specific problems it seeks to solve.
- Weigh alternative options and existing infrastructure, policy or practice to consider whether any new system and its overheads are proportionate for specific use cases.
- Clearly define where use of certification will be permitted, and set out the scientific evidence on the impact of these systems.
- Clearly define where the use of certification will not be acceptable, and whether any population groups should be exempted (for example children, pregnant women or those with health conditions).
- Consult with representatives of workers and employers, and issue clear guidance on the use of vaccine passports in the workplace.
- Develop success measures and a model for evaluation.
- Articulate clear intended use cases and purposes for these systems, and anticipate unsupported uses. Some developers consulted for this study said they designed their systems as ‘use agnostic’, meaning they failed to articulate who the specific end users and affected parties would be. Not having clear use cases makes it challenging for developers to utilise best-practice privacy-by-design and ethics-by-design approaches when designing new technologies.
- Utilise design tools and processes that seek to identify the consequences and potential effects of these tools in different contexts. These may include scenario planning of different situations in which users might use these tools for unintended purposes; utilising design practices like consequence scanning to identify and mitigate potential harms; and employing ‘red teams’ to identify vulnerabilities by deliberately attacking the tools’ digital and physical security features. For the sake of their own product’s effectiveness, it is essential that developers work back from the worst-case scenariouses of their tools to make necessary changes to technical design features, partnership and business models, and use this process to inform impact evaluation and monitoring.
3. Ethical consideration and clear legal guidance about permitted and restricted uses, and mechanisms to support rights and redress and tackle illegal use
Interpretation and application of ethics and law will be particularly local to regions’ jurisdictions, and – as described above – this report does not attempt to do justice to a fully international picture. There are of course some global agreements, and in particular the Universal Declaration of Human Rights and its two covenants, that are universally applicable.
Based on the debates around ethical norms and social values we have been following in the UK, USA and Europe in particular, there are a number of areas of focus in terms of ethics and law.
Personal liberty has been a significant concern in the debate – that vaccine passports might represent the least restrictive option for individual liberties while minimising harm to others. There are important legal tests, in particular respecting a range of human rights, particularly
the right to a private life, which must be considered where people are required to disclose personal information.
Wider concerns raised are around impacts on fairness, equality and non-discrimination, social stratification and stigma at both a domestic and an international level. Specific concerns about harms to individuals or groups, through facilitating additional surveillance by governments or
private companies, blocking employment or access to essential services, will need to be addressed.
Legal and ethical issues should be weighed in advance of any roll-out, and adequate guidance, oversight and regulation will be required.
Before progressing any further with vaccine passports:
- Publish, and require the publication of, impact assessments – on issues including data protection, equality and human rights.
- Offer clarity on the current legality of any use, in particular relating to laws regarding employment, equalities, data protection, policing, migration and asylum, and health regulations.
- Create clear and specific laws, and develop guidelines for all potential user groups about the legality of use, mechanisms for enforcement and methods of legal redress for any vaccine passport scheme.
- Support cooperation between relevant regulators that need to work cooperatively and pre-emptively.
- Make any changes via primary legislation, to ensure due process, proper scrutiny and public confidence.
- Develop suitable policy architecture around any vaccine passport scheme, to mitigate harms identified in impact assessments. That might require employment protection and financial support for those facing barriers to work on the basis of health status; mass rapid testing centres that can be flexed by need (for example, before major sports events) and guaranteed turnaround of results that is fast enough to be used in a passport scheme.
- Undertake human rights, equalities and data protection impact assessments of their systems, both prior to use and post-deployment, to measure their impact in different scenarios. These assessments can help clarify potential risks and harms of systems, and offer clear routes to mitigation. They should be made public and subject to scrutiny by an independent assessor.
- Consider the existing norms of social behaviour that these tools may change. Do these tools grant additional power to particular members of society at the cost of others? Do they open new potential for misuse? The misuse of data collected for contact tracing should act as a warning – contact tracing data from pubs being harvested and sold on to third-parties is an example of unforeseen behaviours that these tools may enable. Mitigating these risks should be built into the sociotechnical design (see below).
4. Sociotechnical system design, including operational infrastructure to make a digital tool feasible
Designing a vaccine passport system requires much more than the technical design of an app, and includes consideration of wider societal systems alongside a detailed examination of how any scheme would operate in practice.
When it comes to technical design, there are a number of models being developed that have different attributes and security measures, and bring different risks into focus. There are commonalities, for example QR codes are widely used with varying degrees of security, but the models are too disparate and varied to summarise in detail here. With some models bringing together identity information and biometrics information with health records, any scheme must incorporate the highest-level security.
Some risks can be minimised to some extent, by following best-practice design principles, including data minimisation, openness, privacy by design, ethics by design and giving the user control over their data. Governments also need to be careful not to allow rapid deployment
of COVID vaccine passport systems to lock in future decisions including around the development of wider digital identity systems (see requirement on future risks).
When it comes to the ‘socio’ part of sociotechnical design, governments need to decide what role they ought to play, even if they choose not to design and implement a system themselves (many developers described their role as ‘creating the highway’ and look to governments to decide the ‘rules of the road’).
Governments (alone, or acting through regional or international governmental institutions) are the only actor that can consider the opportunities and risks (identified above) in the round, and will need to offer legal clarity as well as monitor impact and mitigate harms, so should not step back from this question. They will need to ensure that the operational and digital infrastructure is in place across the whole system, from jab or test through to job or border.
Governments will also need to consider costs – including opportunity costs, maintenance costs and burdens on business – and impacts on other aspects of public health, including vaccination programmes, other public health measures, and public trust in health services and
Before progressing any further with vaccine passports:
- Outline their vision for any role vaccine passports should play in their COVID-19 strategy, whether they are developing their own systems or permitting others to develop and use passports.
- Outline a set of best-practice design principles any technical designs should
embody – including data minimisation, openness, ethics by design and privacy
by design – and conduct small-scale pilots before further deployment.
- Protect against digital discrimination, by creating a non-digital (paper)
- Be clear about how vaccine passports link or expand existing data systems
(in particular health records and identity).
- Clarify broader societal issues relating to the system, including the duration
of any planned system, practical expectations of other actors in the system
and technological requirements, aims, costs and the possible impacts on other
parts of the public health system or economy, informed by public deliberation
- Incorporate policy measures to mitigate ethical and social risks or harms
identified (see above).
- Consider how these applications will fit within wider societal systems, and
what externalities their introduction may cause. While governments should
articulate the rules of the road, developers must acknowledge values and
incentives that they bake into their design and security features, and how these
can amplify or mitigate potential harmful uses of their technology. It is essential
that developers work with local communities, regulators, businesses and
civil society organisations to understand risks introduced by their products,
and tests out how these systems are being used in practice, to understand
their externalities. Failing to do so will not only risk causing further harm to
already marginalised members of society, but lead to reputational damage and litigation or legal liability for developers.
- Proactively clarify with regulators the need for clear legal guidance
on where these systems are appropriate prior to any roll-out or use of
specific applications. In the event a lack of clear guidance from governments
continues, this may result in firms, developers and their users facing legal
liability for misuse or abuse.
- Ensure they develop their technology with privacy-by-design and ethicsby-design approaches. This should include data-minimisation strategies to
reducing the amount of data stored and transferred; consequence scanning
in the design phase; public engagement, in particular with marginalised
communities during design and implementation; and scanning for security
threats across the whole system (from health actors to border control).
- Ensure their systems meet international interoperability standards being developed by the WHO.
- Work with governments and members of local communities to develop training materials for these systems.
5. Public legitimacy
Public confidence will be crucial to the success of a COVID vaccine passport system, and will be highly locally contextual. There are sensitivities involved in building technical systems that require personal health data to be linked with identity or biometric data for many countries. These combine with challenges in the wider sociotechnical system, including financial and other burdens on society, businesses and individuals, to produce concerns about potential harms. A system that is seen as trusted and legitimate could bolster hopes that it might encourage vaccination and updake of booster shots, or inspire more confidence in spaces that require vaccination or testing to enter.
Polling suggests public support for vaccine passports varies based on the particular details of proposed systems (including how they will establish status and in which settings), and concerns about discrimination and inequality. Polling to date only scratches the surface
of these new applications of technology, and deeper methods of public engagement will be needed to properly understand opinion, perceived benefits and risks, and the trade-offs the public is willing to make.
Before progressing any further with vaccine passports:
- Undertake rapid and ongoing public deliberation as a complement to, and not a replacement for, existing guidance, legislation and proper consideration of subjects mentioned above and throughout this report.
- Undertake public deliberation with groups who may have particular interests or concerns from such a system, for example those who are unable to have the vaccine, those unable to open businesses due to risk, those who face oversurveillance from policy or authorities, groups who have experienced discrimination or stigma, or those with particularly sensitivities about the use of biometric identification systems, for example. This would be in addition to assessing general public opinion.
- Engage key actors in the successful delivery of these systems (business
owners, border control, public health experts, for example).
- Undertake meaningful consultation with potentially affected stakeholders,
local communities and businesses to understand whether roll-outs of these systems are desired, and identify any risks or concerns. The negative reaction from parts of the hospitality industry in the UK should be a warning to developers who explicitly cite this use case as a primary reason for developing their system.1
6. Protection against future risks and mitigation strategies for global harms
If governments believe they have resolved all the preceding tensions and determined that a new system should be developed, they will also need to consider the longer-term effects of such a system and how it might shape future decisions or be used by future governments.
Risks to mitigate include the concern that emergency measures become a permanent feature of society. The introduction of vaccine passports has the potential to pave the way to normalising individualised health risk scoring, and could be open to scope creep post-pandemic, including more intrusive data collection or a wider sharing of health information.
Governments should consider the risk of infrastructure passing to future governments with different political agendas, and how tools introduced for pandemic containment could be repurposed against marginalised groups or for repressive purposes. More prosaically there
are maintenance and continuous development costs to consider, as well as path dependency for future decisions generated by emergency practices becoming normalised.
Equally pressing is how one national scheme affects the global response to COVID-19. Despite international coordination, there are significant inequalities of access to vaccines resulting in extreme differences in local manifestations of the virus – both in terms of health and economics. A legitimate concern is that wealthier countries rolling out vaccine passports could further contribute to exacerbating global inequalities, by incentivising vaccine hoarding. For example, vaccine passport schemes could encourage well-vaccinated and contextually low-risk countries to prioritise retaining booster shots to allow their citizens to take international holidays, rather than incentivise global vaccination – which is the only definitive route to controlling the pandemic.
Before progressing any further:
- Be up front as to whether any systems are intended to be used long term, and design and consult accordingly.
- Establish clear, published criteria for the success of a system and for ongoing evaluation.
- Ensure legislation includes a time-limited period with sunset clauses or conditions under which use is restricted and any dataset deleted – and structures or guidance to support deletion where data has been integrated into work systems for example.
- Ensure legislation includes purpose limitation, with clear guidance on application and enforcement, and include safeguards outlining uses which would be illegal.
- Work through international bodies like the WHO, GAVI and COVAX to seek international agreement on vaccine passports and mechanisms to counteract inequalities and promote vaccine sharing.
- Engage in scenario-planning exercises that think ahead to how these tools
will be used after the pandemic. This should include consideration of how
these tools will be used in other contexts, whether those uses are societally
beneficial, and whether tools can be time-limited to mitigate potentially
Requirement one: Science and public health
Read about the first of six requirements that governments and developers will need to deliver to ensure any vaccine passport system deliver societal benefit
- Hancock, A. and Steer, G. (2021) ‘Johnson backtracks on vaccine “passport for pubs” after backlash’, Financial Times, 25 March 2021. Available at: https://www.ft.com/content/aa5e8372-8cec-4b82-96d8-0019f2f24998 (Accessed: 5 April 2021).
Prior to deploying a vaccine passport system, it is essential to have scientific confidence in its impact on public health
It is important that governments state the purpose and intended effect of any COVID vaccine passport scheme
Legal and ethical issues should be weighed in advance of any roll-out of a vaccine passport system, with guidance, oversight and regulation needed.
Designing a vaccine passport system requires much more than the technical design of an app, and includes consideration of wider societal systems