“Slippery Slope” – Vaccine Passports Are A Technical & Ethical Minefield

Authored by Melinda Mills, op-ed via The Financial Times,

I remember the evening a co-worker arrived at our door waving a phone, beaming “I’ve got it!” His Android mobile was the only way to use the UK government app that let EU citizens apply for UK settled status after Brexit. After some unsettling jokes about uploading my private biometric data on his device, we completed the deed and he disappeared into the night. As governments around the world ponder digital vaccine passports, that evening remains in my mind.

Vaccine passports are essentially certificates that link proof of vaccination to the identity of the holder, a potential silver bullet to return to our pre-Covid-19 lives. Before the pandemic, the EU was working on plans for cross-border electronic certificates to replace the paper booklets that many travellers carry. At this week’s EU summit some leaders pressed for further steps towards coronavirus passports.

A recent Royal Society report that I led came up with 12 different criteria that would need to be satisfied to make such passports feasible. This is a complex ecosystem that requires an understanding of everything from immunity and infection to technology, ethics and behavioural factors. But the underlying question must be: what would a vaccine passport be used for?

The head of Heathrow airport has called for digital health certificates to reboot international travel. Estonia and Iceland already link e-vaccination certificates to travel and exclusion from quarantine. Greece is pressing the EU to move quickly. There are precedents such as the airline industry group Iata’s travel pass initiative. But would these certificates only be required for international travel or could they be needed for getting a job, attending a football match, or buying some milk?

Israel recently introduced a green pass heralded as “the first step back to an almost normal life”. It opens entry to gyms, cinemas, hotels and meets some our technical criteria such as verifiable credentials, portability, (attempts at) security for personal data and interoperability. It is valid for six months after a second dose and for “those who have recovered from coronavirus”.

But this could be problematic. Current vaccines protect against severe disease, but we do not yet know whether they stop transmission, how quickly immunity wanes or if they are compromised by emerging variants. Whether someone who has “recovered” meets immunity criteria remains a question. In addition to an expiry date, we would need the ability to revoke a vaccine passport. Israel’s warning of severe punishment for forgery is another reminder of what could go wrong.

There is also the question of mission creep. Recall the UK’s early digital contact tracing app, which raised concerns about privacy, government surveillance and private sector data sharing. Or consider the technical problems with the Tawakkalna app, introduced in Saudi Arabia, which is used for entry into many places but recently froze.

All vaccine passports have the potential to block people from essential goods and services and exclude those who lack identification or do not own or cannot afford a smartphone.

The RS criteria for a workable vaccine passport included equity, ethics and non-discrimination. That means we must ask who would we exclude? There is higher vaccine hesitancy among ethnic minorities and the jabs are being rolled out by age. Plus some people are excluded entirely: children, pregnant women and those with allergies.

Others worry of a slippery slope towards digital health or ID cards. We are already partway there, as I discovered, with Apple’s link with healthcare institutions which allows me to download my immunisation and medical records on to my iPhone. This technology could mean greater efficiency in the health system and better outcomes. But there would be serious ethical concerns if a vaccine QR code that tracks movement is linked to other data — say housing and immigration status — without our knowledge, or if it increases surveillance of already disadvantaged groups.

Credit cards and social media data hold a wealth of behavioural and location data, that companies regularly mine. With vaccine passports, it will come down to trust in government and that can only be won through transparency. There is a risk that the government expends time and money to create a passport system only to have the public recoil in horror.

We also shouldn’t forget we are globally interconnected. When travel resumes, visitors and workers will cross borders and need global standards such the WHO’s Smart Vaccination Certificate. This could be a legal minefield of issues. Human rights and data protection need to be weighed against a duty of care and commercial freedom to act. Governments may make vaccine passports mandatory on economic grounds or to protect public health. Or they may decide to dodge that bullet, but allow businesses to require them instead.

There is also the question of whether a domestic vaccine passport is worth the investment. That depends, of course, on vaccine rollout, virus mutation and other factors. To work, a substantial proportion of the population needs to be vaccinated with universal access, which in most countries is months away. In the meantime, let’s put the pieces of this puzzle together and carefully judge if we like the picture that emerges. 

*  *  *

The writer directs the Leverhulme Centre for Demographic Science at Nuffield College, Oxford university