Α. THE DATA OF PANDEMIC UNTIL TODAY
Over the last 20 years, three new corona viruses have emerged and spread to the human species. The first SARS (2002-2004), first detected in China’s popular markets, spread to 29 countries and infected 8,422 people, causing death in 10% of those infected. Then MERS CoV (2012-present) appeared in the Arabian Peninsula in September 2012, which, until now, has infected 2,519 people and 866 deaths have been recorded (35% mortality). The 2019 coronavirus pandemic (COVID-19) is the third virus to be caused by the SARS-CoV-2 coronavirus, first identified in Wuhan in December 2019, has been spread worldwide, infecting millions of people in 213 countries and causing death of hundreds thousands people until now1.
The urgent situation in the global community due to the current COVID-19 pandemic made crucial the discussion on ways to immediately stop the transmission of the virus. From the data available so far, it seems that the transmission of the virus will stop when more than 60-75% of the population acquires immunity, i.e. it has developed specific antibodies against the SARS-CoV-2 virus. Immunity is achieved in two ways: either naturally, i.e. by infection with the virus, or by vaccination2. Vaccination of a large percentage of the population (over 75%) achieves the so-called “herd immunity”, resulting in limiting the spread of contagious diseases worldwide.
Vaccination constitutes the main tool for primary disease prevention and one of the most cost-effective measures for public health as the best defense against serious and sometimes fatal contagious diseases that can be prevented. The main goal of vaccinations is to reduce the morbidity and mortality of the population from infectious diseases.
Very strict rules apply in the European Union regarding the approval of vaccines, as of course for any other medicinal product3, placed on the market as the European Medicines Agency (EMA) undertakes the evaluation and monitoring of vaccines following their design, and after thorough testing, the European Commission may issue a marketing authorization. In reality, this is a time consuming and costly process, since each candidate vaccine must undergo rigorous pre-clinical and clinical trials by its manufacturer for quality, safety and efficacy followed by a scientific evaluation by the competent regulatory authorities. For this reason, vaccines are mainly licensed centrally, pursuant to European Regulation 726/2004. At this point, it is to be noted that in EU countries where there is no specific vaccine authorization procedure (“under normal circumstances”) the same procedure for any application for marketing authorization of medicinal products4 is followed accordingly.
In the current situation, though, in order to confront public health threats, such as the COVID-19 pandemic, the EU has a specific regulatory tool that allows medicines to be made available in time for emergency use. It is essentially an “urgent administrative approval procedure” containing specific provisions for the fast tracking of vaccine’s approval and conditional marketing authorization, which has been specifically designed to allow granting of marketing authorizations, when adequate data is collected, just in such cases of an emergency. This process provides the EU with a robust framework for faster approval and post-approval assurances and security controls.
Given the current COVID-19 pandemic, the European Commission and the Member States have agreed on joint action to ensure the provision and the adequate and rapid supply of safe and effective vaccines to each Member State according to its population size. On 17 June 2020, the European Commission presented a two-axis European strategy to accelerate the development, manufacture and distribution of COVID-19 vaccines. The EU vaccine strategy aims at ensuring the production of quality, safe and effective vaccines in Europe as well as ensuring rapid access to them for Member States and their populations. In addition, the strategy reflects the global solidarity effort and ensures equal access to affordable vaccines as soon as possible. From the data we have so far, six (6) pre-purchase contracts have been concluded with major pharmaceutical companies for the production and distribution of vaccines in the EU Member States depending on the size of their population and according to the specific terms of each agreement5. It should be emphasized that in line with the EU vaccine strategy agreed with the Member States, each vaccine, once approved and manufactured, is available to the Member States at the same time and under the same conditions. It is also to be mentioned that, utilizing the bargaining power of 27 member states and 450 million people, the European Commission by 19.1.2021 has managed to secure 2.3 billion doses as part of the wider portfolio of safe vaccines against COVID-19 worldwide6.
B. VACCINATION CERTIFICATES
In the context of a coordinated joint approach to pharmacovigilance issues regarding the use of vaccines as well as in the context of disease mutation management, the Greek government proposal for the issuance of reliable and verifiable vaccination certificates throughout the EU is considered as an important tool for the success and the public confidence within the EU regarding the adoption of vaccination schemes.
Recording vaccination data is important at both individual and population levels. At the individual level, it is a means of knowing and proving their vaccination status. In particular, vaccination certificates allow for a clear recording of each individual’s vaccination history, to ensure proper medical follow-up as well as monitoring of possible side effects7. Proof of vaccination should be available from the time the vaccination is started. Vaccination certificates could be used during travel, as they will prove that a person has been vaccinated and therefore may not need to be tested and / or quarantined when visiting another country.
In this context, the Commission and its member states are working along with the WHO for the issuance of vaccination certificates. This work includes a minimum set of data, including a unique identifier, for each individual vaccination, which will obviously facilitate the issuance of certificates and monitoring of vaccination on a pan-European basis once COVID-19 vaccines have been approved.
At this point, it should be noted that, under article 21 TFEU, every EU citizen has the right to move and reside freely within the territory of the member states, subject to the restrictions and conditions laid down in the Treaties and the provisions laid down for their implementation. However, given the current Covid-19 pandemic, which has hit the global population as a whole and in order to protect public health, some restrictions have been imposed by member states on the individual right of EU citizens to move freely within the EU. These measures often consist of entry restrictions or other special requirements applicable to cross-border travelers, such as quarantine or self-isolation or testing for SARS-CoV-2 infection before and / or upon arrival. In this context, in order to ensure a well-coordinated, predictable and transparent approach to the imposition of restrictions on free movement, the Council adopted on 13 October 2020 Council Recommendation (EU) 2020/1475 on the implementation of a coordinated approach to the restriction of free movement in response to the COVID-19 pandemic 8.
Council Recommendation (EU) 2020/1475 sets out the coordinated approach to (a) the application of common criteria and common thresholds when deciding on restrictions on free movement, (b) the reflection of COVID-19 transmission risk based on an agreed color code on a map published by the European Center for Disease Prevention and Control (ECDC)9 and (c) a coordinated approach to measures applicable to people moving between areas, depending on the level of transmission risk in those areas. Of course, for the establishing and enforcing restrictions on free movement, Member States shall comply with EU law, especially with the principle of proportionality and the principle of non-discrimination.
In this context, in order to demonstrate citizens’ compliance with the various requirements of the EU member states, travelers have been asked to provide various types of evidence, such as medical certificates, test results or statements. However, the absence of a commonly accepted and standard document has as a result that the travelers deal with various issues related to the acceptance of their documents, as well as various reports of distorted or even falsified documents10.
On 17 March 2021, the European Commission presented a proposal for the creation of a “digital green certificate” to facilitate free movement in the EU and an accompanying proposal for third-country nationals legally residing in the EU11. The purpose of issuing and holding a single digital green certificate is the facilitation – and not the condition – of exercising the citizens’ right to free movement within the EU. In fact, persons who have not been vaccinated, for example because of medical reasons, because they do not belong to the target group for which the vaccine is currently recommended, such as children, or because they have not yet had the opportunity to be vaccinated or do not want to, they must be able to continue exercising their fundamental right to free movement without prejudice to restrictions, such as compulsory examinations and quarantine / self-isolation. In no case, that is, should the possession of the digital green certificate be linked to the mandatory nature of the vaccination.
In other words, the digital green certificate serves as proof of vaccination, examination and recovery and in particular as a reason for exemption from restrictions on free movement imposed by a member state for reasons of public health, such as the requirement of a diagnostic test or quarantine – and not as a condition to be able to travel within the EU12. The Commission will report on the implementation of the regulation one year after the end of the SARS-CoV-2 pandemic by the WHO, describing in particular the impact of the regulation on free movement and data protection.13
The digital green certificate will cover three (3) types of certificates, namely (a) vaccination certificates, (b) examination certificates and (c) certificates for people who have recovered from COVID-19. The certificates will be issued in digital or printed form. Both versions will include a QR code with the necessary information, as well as a digital signature that will ensure the authenticity of the certificate. Certificates will be available free of charge and will be issued in the official language or languages of the issuing member state and in English.
The Commission intends to create a portal and support member states in developing software that can be used by authorities to verify all certificate signatures across the EU. No personal data of certificate holders will be passed on through the portal nor will it be maintained by the verifying member state.
It is worth noting that the digital green certificate will be valid in all EU Member States and will be open to Iceland, Liechtenstein, Norway and Switzerland. Of course, the digital green certificate system is a temporary measure.
It is noted that it will be suspended as soon as the World Health Organization (WHO) announces the end of the international public health emergency caused by COVID-19.
In the example of Israel, the use of a “Green Pass” is available to anyone who has been fully vaccinated or recovered from Covid-19 in order to access some of the country’s facilities – such as hotels, gyms or theaters. Available as a printed certificate or in an application, which connects users to their Ministry of Health data. The application can also be used for international travels and Israel has concluded agreements with Greece and Cyprus to allow its citizens with vaccination passports to travel to those countries.
In Denmark, there is already a secure digital pass called NemID for access to various online platforms, including digital health, which lists a person’s health records and test results. Denmark has outlined its plans for how to use the Corona Pass internally as a key part of facilitating reopening in the near future. Sweden is considering similar practices, while the United Kingdom is examining the possibility of citizens taking a negative test, as 27 million vaccinations have been achieved so far.
In this context, it is emphasized that digital green certificates should contain only the personal data that is necessary. As personal data contains sensitive medical data, a very high level of data protection should be ensured and the principles of data minimization should be respected. In particular, the creation and maintenance of a database at EU level should not be required, but the decentralized verification of digitally signed interoperable certificates should be allowed.
C. PERSONAL DATA PROTECTION
According to the proposal of the Regulation14 “on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic”, the test certificate shall contain the following categories of personal data: (a) identification of the holder; (b) information about the vaccine formulation administered; (c) certificate metadata, such as the certificate issuer or a unique certificate identifier.
Regarding the right to protection of personal data, including data security, General Regulation 2016/679 applies. There is therefore no derogation from the EU data protection status and Member States shall apply clear rules, conditions and guarantees in accordance with the EU data protection rules. General Regulation 2016/679 establishes the legal basis for the processing of personal data, under the terms of Article 6 (1) (c) and Article 9 (2) (g), which is necessary for the issuance and verification of interoperable certificates. However, according to the proposal of the Regulation15 «on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic», the General Regulation 2016 / 679, does not regulate the processing of personal data relating to documentation of vaccination, examination or recovery for other purposes, such as for pharmacovigilance purposes or for the maintenance of individual personal health records. The legal basis of processing for other purposes should be provided in national law, which should be in line with EU data protection legislation.
The personal data contained in the certificates issued shall be processed for the purpose of accessing and verifying the information contained in the certificate, in order to facilitate the exercise of the right of free movement within the Union during the COVID-19 pandemic. Therefore, according to the principle of personal data minimization, certificates should contain only the personal data necessary for the purpose of facilitating the exercise of the right of free movement within the Union during the COVID-19 pandemic.
Personal data processed for the purpose of issuing certificates, including the issuance of a new certificate, shall not be retained for a period longer than necessary for the purpose of their processing, and in no case shall they be retained longer than the period during which the certificates may be used for the exercise of the right of free movement.
For the purposes of implementing the proposal of the Regulation16, personal data may be transmitted/ exchanged across borders solely for the purpose of gathering the information necessary to confirm and verify the status of the certificate holder regarding vaccination, examination or recovery. In this context, it should be possible in particular to verify the authenticity of the certificate. The personal data contained in the certificates shall be processed by the competent authorities of the Member State of destination or by the cross-border passenger transport service providers which are required by national law to apply certain measures for public health during the COVID-19 pandemic concerning the confirmation and verification of the status of the certificate holder regarding vaccination, examination or recovery. For this purpose, personal data is limited to what is absolutely necessary. Also, personal data should only be included in the certificate issued, which should be protected from falsification or alteration. The information contained in the green certificates may not be retained by the visiting countries. For verification purposes, only the validity and authenticity of the certificate is confirmed by verification of the issuer and its signature. All health data remains on the responsibility of the Member State that issued the digital green certificate17.
D. CONCLUSIONS
In light of the above, with a view to maximizing the safety, health and well-being of the population of each EU Member State, the creation and adoption of a digital green vaccination certificate commonly accepted by EU Member States, in line with the requirements of the applicable legislation on personal data protection (EU 679/2016), is the “key” to regain the trust of citizens in order to restore as quickly as possible their freedom of movement within the EU until the cessation of the virus transmission is achieved worldwide.
Amalia Xeini, Lawyer, Associate with POTAMITISVEKRIS Law Partnership Ioanna Alexopoulou, Lawyer, MSc, Associate with POTAMITISVEKRIS Law Partnership
1. Article by Eleni Patrozou Pathologist – Infectious Diseases Specialist, Sci. Collaborator YGEIA (https://www.hygeia.gr/pandimia-pos-ftasame-os-edo-kai-ti-mas-epifylassei-to-mellon/ )
2 Article by Eleni Patrozou Pathologist – Infectious Diseases Specialist, Sci. Collaborator YGEIA (https://www.hygeia.gr/pandimia-pos-ftasame-os-edo-kai-ti-mas-epifylassei-to-mellon/ )
3 See article 1 of the Ministerial Decision 32221/2013 and article 44 par.1 Law 5945 / 1934-Vaccines are included in the definition of Medicines.
4 “The path to the vaccine for COVID-19 disease”, Dimitra A. Lembesi, OMBUDSMAN Issue 141/2020, September – October 2020
5 “The path to the vaccine for COVID-19 disease”, Dimitra A. Lembesi, OMBUDSMAN Issue 141/2020, September – October 2020
6 https://ec.europa.eu/transparency/regdoc/rep/1/2021/EL/COM-2021-35-F1-EL-MAIN-PART-1.PDF
7 https://ec.europa.eu/transparency/regdoc/rep/1/2021/EL/COM-2021-35-F1-EL-MAIN-PART-1.PDF
8 ΕΕ L 337 of 14.10.2020, p. 3.
9 https://www.ecdc.europa.eu/en/covid-19/situation-updates/weekly-maps-coordinated-restriction-freemovement
10 https://www.europol.europa.eu/early-warning-notification-illicit-sales-of-false-negative-covid-19-test-certificates
11 https://eur-lex.europa.eu/resource.html?uri=cellar:38de66f4-8807-11eb-ac4c-01aa75ed71a1.0002.02/DOC_1&format=PDF
12 https://ec.europa.eu/commission/presscorner/detail/el/qanda_21_1187
13 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0130
14 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0130
15 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0130
