Something to declare? Surfacing issues with immunity certificates

As antibody tests are rolled out, governments around the world are considering how a presumption of ‘immunity’ might enable a more selective approach to managing risk in society. Some form of digital immunity certification or health status app could formally or informally shape how citizens access parts of society, interact with the economy and exercise their rights. As the building of technical capacity for immunity apps, and deliberation about how they might be deployed progresses, this long read surfaces six key issues policymakers must consider up front.

The UK is now rolling out antibody tests across NHS and social care staff, which will indicate whether someone has had COVID-19 by determining whether they currently have antibodies in their system. The development of accurate tests has reopened the idea of an ‘immunity certification’ system. 

While there is little detail around these plans, Health Secretary Matt Hancock has confirmed the UK Government is actively considering how immunity certificates could be used to release some individuals from lockdown, and Dido Harding, appointed to lead the UK’s Test and Trace Programme, has it explicitly in her remit to consider immunity certificates.  

If implemented, these initiatives would create a form of ‘health streaming’ system, in which citizens’ access to parts of society and possible employment, physical spaces, travel or interactions could be contingent on bringing personal private health data into the public sphere. There are also reports of the potential inclusion of ‘health status’ in the NHSX contact tracing app. 

These early explorations into a Public Health Identity (PHI) system, a system for verifiably sharing private health data relevant to public health concerns, are an emerging aspect of the response to the COVID-19 crisis around the world. 

The societal context is that the risk that COVID-19 poses to individuals and society has suspended the usual balance of rights and freedoms, justifying an incursion on liberty and curtailment of rights for the sake of public safety. This risk to individuals and society has made the development of PHIs a possibility across cultures and ideologies, with work underway in China, Germany, the UK and Chile.  

In China, there are now health code apps using a range of data sources, from location to quarantine status. Chile has launched a ‘release certificate’ valid for three months after completion of quarantine following a positive test, to provide reassurance they could help neighbours, although it doesn’t currently allow any relaxation of lockdown or of the need to wear facemasks. The German Government has asked the German Ethics Council to consider how such a programme could fulfil its aims while respecting people’s rights, and expect their recommendations in early June.  

A number of global companies aren’t waiting for a centralised government strategy. MTÜ Back To Work is piloting the ImmunityPassport with Radisson Blu Sky Hotels and other businesses in Tallinn, using Estonia’s existing digital identity system for authentication. PwC are working with Vottun in Spain on a digital health passport, and Ernst and Young are trialling Bizagi’s CoronaPass App with employees and clients.  

Modern digital technology plays a critical role in these systems, as it allows the real-time integration and verification of health-related data and sharing of that data with others, at a speed and scale not previously possible. This technology allows for iterative increases in scope towards a more comprehensive ‘digital identity’, and for the data used and terms of use to change more easily over time than a relatively static physical passport. This opens up the potential of increasingly granular risk assessment or monitoring, even down to the level of an individual. 

The complexity and richness of these issues highlights the need for serious thought before any system is rolled out, and the evidence, policy, practice and societal implications need monitoring and careful shaping. There are a number of issues and risks involved with the roll-out of a digital immunity certification, some of which can be ameliorated through careful policy design and others which are inherent trade-offs of any such system that need consideration. 

In the UK context it is not yet clear what technical design choices the Government might make or what policy framework would be built around immunity – both in terms of centralised use of immunity certification or the permission or restriction of private actors requiring immunity certificates. Policy could span voluntary, non-intrusive measures (public information and guidance, clear legal protections and the expectation of individual personal responsibility to shape behaviour) through to mandatory and highly intrusive measures (selective mandatory reporting requirements or surveillance measures). 

In this piece we raise six issues any government should be considering in the use or permission of these technologies. 

1. We can test for antibodies but we cannot yet test for immunity
2. Communicating uncertainty and risk is challenging; the policy framing of immunity is misleading and could be harmful
3. Any kind of health status streaming is discriminatory – and history warns of stigma
4. Inequalities could trigger or deepen perverse incentives, including undermining solidarity and support for other public health policies
5. ‘Immuno-privilege’ crosses borders
6. These issues must be weighed transparently against the cost of not streaming society by health risk 

Other public health identity systems used to impose differing restrictions on citizens within a society on the basis of risk of infection or transmission of disease will share in whole or in part the issues we raise here, and we will revisit these throughout our future work in this area. 

What is a digital immunity certificate?

In developing plans for Immunity Certification, the Government will need to make a series of technical design choices, which will bring different risks or issues forward. In essence, the aim of a digital certificate would be for an individual to share personal health information (‘immunity’ status or test results) with a third party, who can then make decisions on the basis of that information (ability to work, to enter a space, to join a dating app, or to claim employment support). These third parties will therefore need to be able to trust that the status shared with them is not fraudulent, either through faked testing or real test results belonging to someone other than the individual claiming them.  

Technical design choices will need to be made on:

1. How immunity would be certified. This could be stored locally as part of an existing app or a digital attribute as part of a (new) digital identity system under the control of the individual on their personal device, or centrally, on an NHS health record, or other existing government information systems, e.g. HM Passport Office (HMPO) database, or a completely new central database, e.g. part of the new NHS Coronavirus datastore.
2. The certificate would then need to be verified. For a locally stored certificate, this may simply involve checking whether the provided token is valid and the third party believes the app has not been tampered with by the user. For a centralised certificate, this would involve the third party having some access the electronic record for the particular individual. This might be implemented via an Application Programming Interface (API) that provides a simple yes or no answer to the question of whether a certificate exists for the specific individual. A more sophisticated API might also return more detailed information, e.g. when the person was tested, who they were tested by and what the test results showed. This API might be particularly appropriate for primary care scenarios.
3. The certificate would need to be linked to an individual. One option is to link the immunity certification attribute to an independently verified identity. For a centralised store of the certificates, this would require confirming the identity of the individual before checking the attribute via the API. For certificates held on a personal device, the individual might need to satisfy appropriate authentication requirements, for example, by using their face or fingerprint to unlock the device. This opens up a range of issues relating to the use of biometric identities. 

At present, the implementation decisions that will be made are uncertain.

1. We can test for antibodies but we cannot yet test for immunity 

Six weeks ago, we published a rapid evidence review, in which we set out three tests for any policy approach centred on digital immunity certification: 

1. A sufficiently accurate and reliable test for current immunity
2. Evidence as to the longevity and generalisability of immunity; and
3. An available and affordable test for immunity that can be mass produced and widely disseminated. 

So, have these tests been met? Some yes, but definitely not all of them. 

Two lab–based tests by Roche and Abbott Labs have been verified by Public Health England and approached by the MHRA. Other highly accurate tests also appear to be hot on their heels. The UK Government has said tests will be free on the NHS ‘for those who need them’ and will reportedly be prioritising health and social care workers; private testing is opening up via high street pharmacies from c.£70 each. The government has signed a contract to supply more than 10 million tests over the next few months, but whether production can be scaled up and economies of scale or government provision can drive down the cost to provide affordable and available testing before immunity certification is still uncertain.  

The evidence on longevity and generalisability of immunity is where the real and significant uncertainty still lies. As Daniel Altmann lays out, there are still crucial questions for policymakers for which we don’t yet have an answer. We still do not have a clear idea what having antibodies means for the individual – in other words how solid is the assumption that antibodies equate to immunity.  

Studies have found that 10-20% of those who had had symptoms have little or no detectable antibodies, but it’s not clear what conclusion can be drawn from that insight, and currently most of the serological data is drawn from individuals who have been hospitalised, which doesn’t reflect the general population.  

Even if presence of antibodies is likely to confer a level of immunity, the virus is too new to know about longevity of immunity. We can make guesses based on other viruses and the similarity of observed immune responses (where one might expect at least a year of antibodies), but finding out more about longevity and generalisability will simply take time and patience. 

While the science will evolve, discussing ‘immunity’ as a binary attribute is currently misleading and dangerous. Instead we should see antibody tests as offering limited emerging insight into prediction of risk of infection and transmission.  

2. Communicating uncertainty and risk is challenging

With still so much unknown about the relationship between the presence of antibodies and the degree of immunity a person may have to COVID-19, talking about ‘immunity certification’, based on the results of an antibody test, may give a false sense of certainty. 

‘Certificate’, ‘passport’, ‘license’ and similar framings suggest a permanence that is misleading and potentially damaging. It also creates a binary view of ‘safe’ versus ‘unsafe’, versus what is ultimately a spectrum of risk influenced by a number of other factors beyond the presence of antibodies. 

But despite scientific caution, we are seeing antibodies interpreted by governments as shorthand for immunity. For example, in Baroness Dido Harding’s appointment to lead the NHS’s track and trace programme, her remit includes antibody testing and immunity certification, implying one naturally leads to other. No doubt the use of this framing by governments and companies leads to the public similarly having false certainty in the relationship between antibodies and immunity. 

Instead, researchers and officials need talk about these tests and the possibility of immunity, its longevity, generalisability and other aspects in terms of uncertainty. There is a tendency for people to convert probabilities into absolutes, either yes or no, and round down low risk into no risk. So, we should emphasise presenting any results as a risk, either low versus high risks, or even a probability range, that an individual will not be infectious in x weeks, rather than simply a positive or negative result on a particular test. This needs to be kept in mind by anyone designing an app or website interface. 

We also need to be clear about contextual risks, for example the prevalence of the virus in the places that individuals are likely to spend their time. We may have very different standards for healthcare workers, who face much greater contextual risks of infection and transmission but also may be able to benefit society the most if they can act in greater knowledge of that risk, even if that risk cannot be guaranteed to be negligible.  

Ultimately, public communication must be informed by experts to ensure users understand the any certificate’s purpose, the quality of its evidence, risks and limitations, users’ rights as well as how to use the certificate. And this communication must be proactive and pre-emptive, rather than after antibody testing has already been widely distributed. 

3. Any kind of health status streaming is discriminatory – and history warns of stigma

Immunity certification or any kind of health status streaming is inherently and intentionally discriminatory; it explicitly based on privileging socioeconomic participation or performance of rights on the basis of immunity. 

Depending on how these are policed, it may also reinforce existing discriminatory practices, such as stop and search. This would particularly compound the existing oversearching of ethnic minorities, given they appear to suffer disproportionately from COVID-19 in the UK. 

Existing legal regimes may also be ill-equipped to prevent discrimination even if immunity certification is not explicitly state-sanctioned. The Equality Act 2010 protects against discrimination based on disability including progressive illness but it is unclear whether it would cover a lack of antibodies, which in most cases would be seen to mean no illness has taken place. 

Further, it may create new kinds of stigma. As Hannah Clapham and others note, in societies where status is often linked to employment, those who are unable to return to work may be stigmatised as ‘immunologically unfit’. More generally, informal social stratification may develop around the idea of ‘immunological fitness’. 

While people are focusing on potential stigma associated with those without antibodies, neither the long-term impacts of COVID-19, nor the comorbidities associated with it, are understood. Disclosing immunity might unwittingly reveal underlying health risks or genetic information. As Virginia Berridge highlights in AIDS in the UK: The Making of Policy, 1981-1994, in the early days of HIV, to be HIV positive was seen as a good thing, as it indicated antibodies to the virus. Only later did the true meaning and implications of being HIV positive emerge. Once publicly shared, digital records of antibodies may prove to be much more difficult to destroy or subsequently conceal than a physical document, which may make any such stigma harder to avoid. 

4. Inequalities could trigger or deepen perverse incentives, including undermining solidarity and public support for other public health policies   

Any system of certification will necessarily involve some rationing and prioritisation of antibody testing. 

The UK Government is initially offering tests to healthcare workers, who face the greatest risks of infection and transmission. Increased knowledge of healthcare workers’ risks will allow those at lower risk to face the situations with a greater chance of exposure, both saving other healthcare workers and reducing the overall transmission to patients, who will be disproportionately vulnerable people. Thus, prioritising their testing is likely to be significant social multiplier. 

Provision may then move to other key workers, who can equally make a case for having served a socially beneficial role in the crisis and that optimal allocation of low-risk key workers can reduce transmission to vulnerable communities. 

Alongside free tests, the Government has allowed for private provision of antibody testing, which will skew toward the better-off in society, further entrenching inequality proportional to reductions in restrictions associated with any immunity certification scheme. 

If immunity certification is given to priority groups to go back to work, it may also undermine solidarity within the population by creating a two-tiered system of citizenship which leads to resentment and a feeling of inequity. This may then lead to a breakdown in compliance with social distancing measures with individuals prioritising their own interests as they feel others are not bearing an equal burden. 

While ‘immunity’ confers lower risk to individuals and therefore to businesses, private companies may offer, pressure or require employees to take tests and provide results. Imagine gig economy apps requiring you to connect your digital immunity certification before you can sign up, or parents preferring childminders who have had the disease. People might also choose to self-certify, if access to the labour market is formally or informally contingent on antibodies, even if there is no active pressure from firms. 

This raises the issue of falsification or, more dangerously, individuals actively seeking out infection as Alexandra Phelan warns in the Lancet may occur if participation in society and economic activity requires proof of antibodies. 

These incentives will not be felt equally by everyone in society. Those who have the financial resources or social support systems to be able to forgo work will face weaker incentives. Whereas those who have limited employment options and those with limited access to government support, for example those with no recourse to public funds, will have the strongest incentives, likely compounding existing gender, race and social mobility inequalities. 

This may go beyond access to work. Whether formally required or informally expected, ‘immunoprivilege’ may extent to access to space, travel and dating apps.  

5. ‘Immuno-privilege’ crosses borders

If access to antibody tests becomes viewed as a strategic resource for reopening economies, then there may also be international unfair access to testing, as wealthy countries buy up the world’s supply of tests, exacerbating global inequities between high-income and low-income countries. 

Natalie Kofler and Françoise Baylis point to another potential source of international tensions arising from immunity certification systems. If countries do not implement or even ban such systems, or even if their digital systems are not interoperable, their citizens may be barred from entering countries that mandate them or may find their travel restricted. This may prove particularly problematic between states have that historically expected free movement, e.g. if European states take diverging paths on immunity certification. 

There is a precedent for disease-based travel discrimination. People with HIV are already subjected to restrictions on entering, living and working in countries with laws that discriminate against those with non-conforming gender or sexuality, such as Russia, Egypt and Singapore. 

6. These issues must be weighed transparently against the cost of not streaming society by health risk 

Brown et al. ask whether we can justify not using such a system, even with all the above problematic issues, in light of the risks of the alternatives. 

What if testing, tracking and tracing systems can be rolled out at scale and prove effective in controlling new outbreaks with only targeted isolation or local quarantines, rather than indiscriminate lockdowns? Then the benefits of digital immunity certification systems to individuals and society might be quite marginal, outside of high-risk sectors like health and social care. 

Alternatively, what if severe restrictions must continue for a significant period of time? Then we have to consider whether it is fair to unnecessarily restrict the civil liberties of those who may not be a risk to others. Enabling those less at risk to return to work may also benefit those still under harsher restrictions, and allow more support for those who are still at risk, making it easier for them to endure tighter restrictions. 

It may be that even in this scenario, the downsides and risks for society and individuals outlined above outweigh the benefits, but that is something we have to acknowledge explicitly and collectively. 

It will be critical to resist policy or political momentum unless there is transparent discussion of the social issues and how they might be mitigated.

What is the Ada Lovelace Institute going to do? 

The complexity of these issues highlights the need for serious thought before any system is rolled out. Whether in the form of immunity certification or more generalised public health identity systems, the evidence, policy, practice and societal implications need monitoring and careful shaping.  

Over the coming weeks, the Ada Lovelace Institute will be tracking public and private uses of immunity certification and broader public health identity systems and considering how we can systematically compare these efforts. 

Further Reading

• What policy makers need to know about COVID-19 protective immunity by Daniel M. Altmann, Daniel C. Douek, and Rosemary J. Boyton 
• COVID-19 immunity passports and vaccination certificates: scientific, equitable, and legal challenges by Alexandra L. Phelan 
• The Dangerous History of Immunoprivilege by Kathryn Olivarius 
• Ten reasons why immunity passports are a bad idea by Natalie Kofler and Françoise Baylis 
• Ethical Implementation of ‘Immunity Passports’ during the COVID-19 Pandemic by Teck Chuan Voo, Hannah E. Clapham and Clarence C. Tam 
• Social Licensing of Privacy-Encroaching Policies to Address the COVID-19 Pandemic, United Kingdom Attitudes by Stephan Lewandowsky 
• Immunity Passports for SARS-CoV-2: an online experimental study of the impact of antibody test terminology on perceived risk and behaviour by Jo Waller, G. James Rubin, Henry W. Potts, Abigail Mottershaw and Theresa M. Marteau