Governments must offer clarity on vaccine passports

As COVID-19 vaccination is rolled out across the United Kingdom, and across the world, there is an urgent need to consider the benefits and risks of ‘vaccine passports’ and COVID status apps – digital applications that display whether an individual has had a vaccine, a recent test, and other forms of related information. What would it mean if your employer demanded vaccination proof to come to work, your insurance premiums rose if you couldn’t provide proof, or you couldn’t join dating sites without it?

There is no question that vaccine status may begin to be shared or requested informally, and governments, even while considering their own certification regimes, should be on the front foot in outlining when such requests are appropriate, safe, and lawful. Around the world we are seeing nascent examples of countries and companies calling for or trialling forms of COVID passports. Most notably the World Health Organisation is recruiting for technical experts for vaccine certification and establishing a Smart Vaccination Certificate consortium.

Careful thought, the right technical format, and new laws and guidance to mitigate inequalities are among the protections that will unquestionably be needed. While these systems are already being rolled out, there remain some substantial unanswered questions including:

• What is the current scientific understanding of how different vaccines affect individuals’ relative risk of disease and transmission?
• What are the possible current and future, public- and private-sector uses of vaccine passports and COVID-19 status apps?
• What technical design decisions can and should be made, to maximise benefits and mitigate against potential harms?
• How do existing laws and regulations apply to vaccine passports and COVID-19 status apps and will new ones be needed?
• What are the ethical trade-offs involved in discriminating on the basis of vaccination status to grant different freedoms to groups of people?
• What are the potential social impacts, including stigmatisation and discrimination; loneliness and economic scarring?

Vaccines have been approved by regulators to protect against the risk an individual faces of infection and the outcome of the disease. The hope – not yet proven – is that in addition to reducing the risk that they become seriously ill, they will also prevent people from spreading the virus.

The argument for some for a vaccine passport or an app which displays your COVID status is that a regime in which there is clarity about the risk an individual faces or poses should better enable families, public services, companies and employers to manage personal and collective risk, striking a better balance between universal restrictions and individual liberty and at a macro level improving societal and economic outcomes.

The case for passports is that offering tests or vaccines and enabling people to manage their risk accordingly won’t be effective without some form of certification, and that entry to some spaces or activities will require that proof.

Creating tools that share an individual’s private data, or information about their risks poses real challenges and dangers and presents two big direct risks:

1. Private health data is circulated to multiple actors with unforeseen or harmful consequences to individuals’ employability, insurability, social status and other important aspects of social participation. Unlike state-run digital contact tracing, a vaccination passport or app would share data with multiple unconnected and unregulated parties.
2. Segregating or limiting rights and freedoms on the basis of health status has unforeseen or harmful consequences to society, such as exacerbating inequalities, even creating or reinforcing disenfranchisement and minority group discrimination (at a national and global level), shifting risk and compounding the already disproportionate effect of COVID-19 on marginalised communities.

There is a further indirect risk arising from the creation of a digital infrastructure of personal risk profiling that, once used, may be a core part of our social and global fabric: the pandemic is creating the conditions for an acceleration of individualised risk scoring. Any digital vaccination certificate that is linked to the identity of an individual, particularly if it operates at a supranational level, delivers significant power to the controllers of that infrastructure that will be hard to dissolve or dismantle post-crisis.

These risks may not be insurmountable and the counterfactual – keeping vaccination as a private health concern rather than a public piece of information – may come at too great a social cost. The practical additional burden placed on state capacity may be outweighed by the net benefits of vaccination certification in some settings, such as health and care, where it may be worth trade-offs to manage the risks staff face.

Saying or doing nothing may create the worse of all worlds – leaving the door open to a myriad of private uses of vaccination certificates with no oversight, each with different approaches to security and identity, exacerbating inequalities and compounding the already disproportionate effect of COVID-19 on marginalised communities.

The Ada Lovelace Institute is launching a new project to explore these questions and help inform any Government response in the UK and elsewhere. Today we launch a call for evidence and announce a deliberative expert body, chaired by Professor Sir Jonathan Montgomery, to consider possible scenarios for rolling out certification apps and the challenges and opportunities they present.

Image credit: RobertAx