Part II – Digital Health Passports in Europe: Amended Proposal for a Digital Green Certificate and Eligible Testing Methods

In March 2021, the European Commission released a proposal for the creation of a “Digital Green Certificate,” which will allow EU citizens to travel easier throughout the EU during the COVID-19 pandemic. Last week, the EU Member States agreed on some proposed changes to the proposal, including strengthening of the data privacy provisions. According to the proposal, in order to obtain a Digital Green Certificate, individuals must prove that they have been vaccinated, present a negative test result, or have recently recovered from COVID-19. The proposal allows the issuance of a certificate for all COVID-19 vaccines, which have received an EU-wide marketing authorisation, however only the results of certain in vitro diagnostic tests will be considered valid.

As we previously discussed, on March 17, 2021, the European Commission introduced its proposal for a Regulation on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic. The proposal seeks to create the “Digital Green Certificate” for EU citizens, which will facilitate free movement inside the EU during the COVID-19 pandemic.

On April 14, 2021, the EU Member States, represented by the European Council, agreed on a mandate for negotiations with the European Parliament on the proposal for a Digital Green Certificate.

Based on the revised text of the Council, the European Parliament is expected to adopt its position at its plenary on April 26-29, 2021. The interinstitutional negotiations will start as soon as possible thereafter. Member states underlined their commitment to have the framework ready by summer 2021.

What is the “Digital Green Certificate”? The Certificate will be used as a proof that a person has been vaccinated against COVID-19, received a negative test result, or recovered from COVID-19. EU citizens will be able to obtain the Certificate free of charge, in digital or paper format. The EC will build a gateway to ensure all certificates can be verified across the EU, and support Member States in the technical implementation of certificates.

As reported in Part I, the EC is taking several steps to resolve potential data privacy concerns, a number of which were flagged in the recent Joint Opinion published by the European Data Protection Board and the European Data Protection Supervisor, e.g., by collecting only the minimum amount of personal data necessary to achieve the intended purpose of the Certificate.

What changes has the Council proposed? The Council has proposed a number of changes to the Proposal issued by the Commission, including, inter alia, to strengthen the data protection provisions and incorporate certain of the recommendations in the Joint Opinion. For example, the Council’s draft:

• states that to the extent the chosen verification solution requires a transfer of personal data outside of the European Economic Area, such transfer shall be carried out in accordance with the requirements of the EU General Data Protection Regulation and the data minimisation principle thereunder; and
• clarifies that the personal data collected as part of the Certification may only be processed by Member States for the purpose of accessing and verifying the information included in the Certificate in the context of the pandemic. Where Member States want to process the personal data collected for a different purpose, this will only be permitted to the extent there is a valid legal basis to do so and provided the storage limitation principle is complied with under the GDPR.

We understand that the Council expects the data protection provisions to be further revisited during the negotiations with the European Parliament.

What types of certificates are covered? To preserve the right to free movement, in addition to a vaccination certificate, the Commission also proposes to create COVID-19 test certificates and certificates for persons who have recovered from COVID-19, a so-called certificate of recovery.

Which vaccines will be accepted for a vaccine certificate? According to the Proposal, a vaccine certificate should be issued by Member States for COVID-19 vaccines (a) that have received marketing authorisation pursuant to Regulation 726/2004, or pursuant to Directive 2001/83/EC, or (b) the distribution of which has been temporarily authorised pursuant to Article 5(2) of Directive 2001/83/EC.

Which COVID-19 tests will be accepted for a test certificate? To ensure the reliability of the test result, only results of molecular nucleic acid amplification tests (NAATs) and rapid antigen tests will be eligible for the test certificate.

NAATs used must be intended to detect the presence of the SARS-CoV-2 ribonucleic acid (RNA). Examples of suitable NAATs include, inter alia, reverse transcription polymerase chain reaction (RT-PCR), loop-mediated isothermal amplification (LAMP) and transcription-mediated amplification (TMA) techniques. The list of NAAT examples is not exclusive and other tests not specifically mentioned can also be used provided they fulfil the requirements of the Proposal.

A test certificate may also be issued based on a rapid antigen test that relies on detection of viral proteins using a lateral flow immunoassay and that gives results in less than 30 minutes. Rapid antigen tests eligible to be used for the test certificate must be listed in the common and updated list of COVID-19 rapid antigen tests established on the basis of Council Recommendation 2021/C 24/01. The Council’s amended proposal suggests clarifying that the tests must be carried out by health professionals in the EU Member State issuing the certificate.

NAATs and rapid antigen tests used to issue certificates of recovery must meet the same requirements as those set out above.

Will certificates issued outside the EU be accepted? The Proposal, once adopted, would apply to the European Union and, by incorporating it into the European Economic Area Agreement, also to Iceland, Liechtenstein and Norway.  With respect to Switzerland, the Commission may decide whether to accept Swiss certificates issued in accordance with the Proposal based on reciprocity. It is currently unclear whether the Commission plans to extend such reciprocity to UK-issued certificates.

Non EU citizens?  The Commission has also issued a proposal for a Regulation on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to third-country nationals legally staying or legally residing in the territories of EU Member States during the COVID-19 pandemic.

Next Steps

The EC has expressed the desire to implement the Proposal in a swift manner and before summer 2021. In response, in late March, the Parliament voted to use the urgency procedure for the adoption of the Proposal.

As mentioned above, based on the revised text of the Council, the European Parliament is expected to adopt its position at its plenary on April 26-29, 2021. The interinstitutional negotiations will start as soon as possible thereafter. The EU Member States have underlined their commitment to have the framework ready by summer 2021.

In light of these developments, interested parties are advised to continue monitoring the final text and implementation of the proposal, in particular as it relates to the data privacy requirements as well as the types of tests that are eligible to issue the relevant certificates.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.