National vaccine passports: issues for the issuers

Interoperability, privacy, and fairness in procurement are key considerations in vaccine passport design

Note: This article was originally published via Apolitical.co on November 16, 2021.

• The problem: The adoption of vaccine passports for travel and domestic use has thrown up similar issues for governments globally.
• Why it matters: Issues such as data privacy and use across different countries are key to a successful rollout of the passport and can help to boost vaccine uptake.
• The solution: Designing a robust product that addresses the key issues via a competitive procurement process.

October was a big month for countries looking to introduce vaccine passports. On October 1, France formally rolled out the Pass Sanitaire to all residents aged 12 and up. Two days later, Israel updated the eligibility rules for the Green Pass to require a booster or second dose within the past six months. In my home country of Canada, the federal government introduced a framework to standardise existing provincial vaccine passport programs.

The recent measures taken by France, Israel, and Canada reflect a broader international effort to implement vaccine passports for international travel and domestic use. As of October 28, more than 120 countries have already introduced proof of vaccination certificates (PVC) to ensure widespread immunity.

Vaccine passport uptake by country, as of October 28, 2021. For a detailed breakdown of the requirements in each country, visit: https://www.movehub.com/blog/countries-using-covid-passports/

The benefits of a PVC program

A national vaccine passport can offer many advantages to citizens. For starters, it can allow a country’s residents to visit their loved ones internationally while using an application with a QR code or vaccination record. Additionally, it can provide a nationwide solution for local governments and businesses that already require PVCs for non-essential activities.

Another advantage is that the announcement of a vaccine passport is often followed by an increase in vaccination uptake. For example, France saw 3.7 million vaccination appointments in the week following the announcement of their passport plans. Countries with higher levels of vaccine hesitancy may consider the introduction of PVCs to better protect their citizens.

Lastly, vaccine passport programs can be framed as temporary measures which can be scaled back once certain vaccination thresholds are reached. For example, Denmark announced the end of its domestic passport program because the share of the eligible population fully vaccinated was more than 86%. Similarly, Ireland intends to wind down its program by February 2022. By introducing PVCs with a sunset clause, it may be possible for governments to obtain a buy-in from vaccine-hesitant communities.

Potential legal and technical issues

Although such programs have a number of advantages, governments should be mindful of the legal and technical issues faced in other jurisdictions before implementing their own passports. These considerations include privacy, interoperability, and fairness in procurement.

The privacy implications of PVCs should be front of mind for policymakers. Much of the health information needed for an individual to declare their vaccination status is legally protected, and would require some form of consent to be accessed. In federal systems like the US and Germany, central governments may need to further ask for permission from provincial or state governments that maintain jurisdiction over healthcare services. In designing a national passport, measures should be taken to:
(1) limit the health information required for a QR code to be produced
(2) store information within the memory of a user’s device (rather than in a cloud or network)
(3) establish deletion dates on passport information to ensure that records cannot be leaked or stolen from the user.

Additional consideration must be given to the passport’s interoperability, especially if it is being designed to have recognition abroad. Several platforms have emerged over the past year to address the potential gaps in cross-border integration. For example, the European Union built a digital COVID certificate (EUDCC) gateway to facilitate travel across the continent. Although each member state is required to develop their own proof of vaccination programs for international travel, the EUDCC gateway acts as the intermediary between passport apps to ensure EU-wide recognition.

Other platforms have grown in popularity among industry associations and non-governmental organisations. These include the airline sector-led IATA Travel Pass and the Commons Project’s CommonPass. In North America, the Smart Health Card system has emerged as the most popular option due its high level of uptake from verified issuers such as state and provincial governments, pharmacies, and allied healthcare providers. Additionally, the QR code tied to a Smart Card can be scanned by the Commons Project’s verifier app to identify the user’s name, vaccination status, and passport issuer.

Competitive procurement

Given the challenges governments will face in ensuring that vaccine passports balance privacy with interoperability, policymakers should consider outsourcing the app’s development through public procurement. The COVID-19 pandemic has placed government contract policies under heavy scrutiny, as was demonstrated by the extensive media coverage on vaccine supply deals and PPE award scandals. The political sensitivity of the vaccine passport file means that governments should seek proposals through competitive bidding processes to avoid accusations of preferential contracting.

When looking to see how a competitive procurement process can lead to a well-designed PVC product, Germany’s CovPass app provides a strong case study. The German government outsourced the app’s development through a competitive process to a consortium led by IBM. Despite the urgency in developing a vaccine passport system, Germany undertook a points-based bidding process for CovPass to ensure that quality and price were given strong consideration. IBM won the €2.7M contract in part because of its commitment to subcontract 51% of the award value to partners such as a company specialising in blockchain solutions. These attributes ensured that Germany’s CovPass would comply with the EU’s rules on data and interoperability.

As countries begin to reopen their economies to the rest of the world, national governments must balance public health needs with privacy concerns. When implemented correctly, vaccine passports can uphold both these considerations. By learning from jurisdictions with successful implementations, such as those in Europe, policymakers can introduce passport programs that encourage vaccine uptake, international recognition, and fairness in procurement.