U.K., EU Face Privacy Criticism for Covid-19 Passport Plans

Britain’s National Health Service is developing digital and nondigital ways for individuals to show proof of their virus status with “security and privacy at the core of this approach,” according to a government document published on Monday, as the U.K. prepared to start relaxing its lockdown restrictions. Up to 20,000 people could be admitted into London’s Wembley Stadium for the May 15 FA Cup game, the document said.

A system to process massive amounts of personal data, particularly sensitive health information, comes with privacy risks, said Eduardo Ustaran, co-head of the privacy and cybersecurity practice at law firm Hogan Lovells International LLP. “The success or effectiveness of vaccine passports is about getting data protection right,” he said.

The U.K. government said it will develop digital and paper versions of the certificate, but hasn’t disclosed details. Government agency Innovate UK says it has funded 10 technology companies to develop and test virus certificate systems.

Some British lawmakers and business groups have criticized the plan, arguing that virus certificates would cause discrimination against people who haven’t received a shot or don’t want to share their health data.

The document published Monday said the government is studying whether to eventually introduce the certificate system more widely, in areas such as hospitality. Prime Minister Boris Johnson said last month that pub owners may be allowed to decide if they will require certificates.

Requiring proof of individuals’ virus status for attending events or entering buildings within the U.K. will create a “checkpoint society where we’re asking each other and anyone with authority can ask you about your health data, which is obviously some of the most sensitive data we have,” said Silkie Carlo, director of Big Brother Watch, a privacy advocacy group based in London.

In the European Union, legislators last month proposed rules for a certificate system to demonstrate the virus-test and vaccine status of people moving between the 27 member countries, allowing them to travel without additional tests or quarantine restrictions that may be required in the countries they are visiting.

Officials have said they want the law, known as the Digital Green Certificate, to take effect in June. The European Commission, the EU executive body that drafted the legislation, said it will help authorities in member countries develop software to check QR codes on the certificates, which travelers will be able to use either in digital or paper form.

Airlines and tourism industry groups say the EU-wide system could encourage travel after a year of lockdowns. But questions remain. It hasn’t been determined whether airlines will handle passengers’ data when they check the virus certificates, and such a requirement would make companies responsible if information is mishandled, said Agnès Leroux, policy director at Airlines for Europe, which represents carriers including International Consolidated Airlines Group SA’s British Airways, and Deutsche Lufthansa AG .

“Any mistake, any data that would leak or be misused can then create fines. It would also mean close scrutiny from data privacy authorities at national level on airlines,” Ms. Leroux said.

Authorities operating the EU certificate system should define how long they will keep personal data, and how long the certificates will be valid, European privacy regulators said in an opinion paper published this week. They also warned against setting up a centralized database to store Europeans’ health data.

Under privacy laws in the U.K. and the EU, any application or tool that collects sensitive health data will have to be reassessed if authorities want to expand their use beyond the purposes they initially propose, such as for people attending large gatherings or international travel, Mr. Ustaran said. The law requires companies and organizations that collect personal data to make sure individuals give permission for their information to be used for a certain purpose, and to obtain permission again if their data will be used for any additional application. The U.K., which left the EU last year, still applies the bloc’s General Data Protection Regulation.

In addition, Mr. Ustaran said that operators of coronavirus certificates would need to delete data when it is no longer valid, depending on how long immunity and vaccine protection lasts—which scientists still don’t know. The GDPR requires companies to keep the minimal amount of data necessary and delete information they no longer need.

As well as privacy concerns, critics have raised questions about the practicality of vaccine-certificate systems.

One issue is whether people will be able to prove they are vaccinated, immune or have tested negative for the virus. Emma McClarkin, chief executive of the British Beer & Pub Association, noted that pub workers, nearly half of whom are under 25 years old, largely haven’t been vaccinated.

Adam Brooks, the proprietor of two pubs in Essex, England, estimates that hiring someone to check vaccine certificates at the door would cost him between £800 and £1,000 a week, or roughly $1,100 to $1,375. “This logistically would be impossible for pubs, restaurants and cafes to implement because we’d have to have someone at the front door from open to close,” he said.

Plus, people who are turned away because they lack the proper certificate or didn’t receive a vaccine could become aggressive toward pub employees, said Mr. Brooks, who said he plans to open outdoor service at one of his pubs, the Owl, next week.

Write to Catherine Stupp at [email protected]