Select a region
Express speaks to a trio of local experts to answer the three key questions over vaccine passports...What are the legal issues? What are the data issues? And how would it work?
The phrase ‘vaccine passport’ is just another one we’ve had to get used to in the last year, one to file away with ‘physical distancing,’ ‘aerosol dispersal’ and the strictly nonsensical, ‘self-isolate.’
With immunization being pursued by many governments, including ours, as the best way through the pandemic, the idea of creating some form of ‘vaccine passport’ has been gathering pace, in order – presumably – to determine our access to travel, services, and in some cases, even employment.
British Airways plans to allow its passengers to upload their vaccination details in the 'Manage my booking' section of their smartphone app to prove they are “safe to fly.”
They won’t be the only ones – and so this month, Express takes a look at three different perspectives on what's likely to be one of the main talking points of the summer...
The media is full of reports about vaccine passports and how they are going to open up our lives again and restore a degree of normality. Frankly, after the last 12 months, if vaccine passports provide a route out of the pandemic, whether you are a government, a company or an individual, what's not to like? Possibly quite a lot.
Let's start with the science. Or rather the non-science. Until the beginning of March 2021, European countries were denigrating the Oxford-AstraZeneca vaccine ("almost ineffective" was how President Macron described it) and some of their citizens were refusing to have it; yet, on 4 March 2021, Italy refused an export licence of 250,000 doses to Australia, and President Macron suddenly decided that he (and his fellow citizens) would be happy to have the Oxford vaccine. ‘Hero to zero,’ and back to hero in less than a month. And that rather provides the context for any debate about vaccine passports.
The science, and the commentary around the science, are extremely fast moving. I think it is far from clear what exactly an individual's vaccine status means, beyond them being less likely to get the disease, and less likely to be hospitalised if they get it. As an eminent panel of expert scientists noted in a report published by the Royal Society in February 2021, "vaccines can provide a high level of protective immunity against the Covid-19 illness… Vaccines are likely to be less effective in preventing infectiousness and transmission, but there are presently limited data to determine how much less.” Before we endorse vaccine passports, we need to understand what a person's vaccination status actually means.
Put simply, if, as the studies suggest, vaccines have a 70% to 95% efficacy, the vaccine status of between 5% and 30% of those vaccinated is wholly irrelevant, and we do not know who those people are. Similarly, it is wholly unclear at present whether everyone's vaccine reaction is identical; and it is not inconceivable that some form of additional antibody test might be required before a passport could be issued to show that an individual actually has the immunity they hope to have.
Moreover, until we know (in the case of each vaccine and combination of vaccines) how long vaccine protection lasts, and over what period the protection wanes, vaccine passports may just be a populist soundbite.
Governments too are vacillating. Despite vaccination being almost universally trumpeted as the way out of the pandemic, no country has yet mandated nationwide vaccination, or made it a criminal offence not to be vaccinated without a reasonable excuse. Let's put that into context from a Jersey perspective - the States of Jersey evidently think that picking roadside flowers, failing to keep adequate tax records, and littering (all of which are criminal offences) are more socially unacceptable than not having the Covid-19 vaccine.
Further, governments generally have not even tried to articulate what the consequences of vaccination, or rather non-vaccination, might be. And it is not as though any of this is new. In Australia, in 2015, ‘no jab no play’ became a policy whereby benefits were withheld for parents of children who were not fully immunised against measles, and fines were imposed on childcare centres that admitted un-vaccinated children. Similarly, in France and Italy, a ‘no jab no school’ policy was introduced in 2017 when the MMR vaccine was made compulsory, before children could start school.
The reasons behind the lack of enforcement by governments may be varied, and linked in part to the science, the patchy progress and the discriminatory nature of vaccine roll out through populations. There may also be a concern that it would be counterproductive to mandate vaccination when so much of our response to the pandemic to date (and in the future) has been (and will be) based on mutual social responsibility. That said, this stance may well change as the roll out progresses and the science evolves.
In the meantime, individuals, employers and businesses should be very careful before entering areas where governments fear to tread. Discrimination laws are there to protect all of us from, ‘less favourable’ treatment, or even different treatment, in a variety of situations, simply because of the way we look, our age or because of some other, unjustifiable, basis.
Vaccine roll out in Jersey is, in the main, based on age so there is an inherently discriminatory element to the use of vaccine status for anything at present.
In addition, disability is defined as a ‘long-term physical impairment’ and there is no reason why this couldn’t include not having Covid-19 antibodies or immunity. Excluding un-vaccinated people from premises, shops, jobs, sports, education and any other goods, facilities and services could be unlawful direct discrimination. Failing to make reasonable adjustments to allow them to access these things would be indirect discrimination. But that is only one side of the equation. Employers and business owners have duties to ensure that their premises are safe for other employees and customers and having an unvaccinated, super-spreader on the shop floor is not going to achieve this. We are all going to have to pick our way carefully between these competing interests and deciding how we, as a society, identify and deal with those people who do not have the appropriate level of immunity is going to be a challenge.
"Reasonable adaptations" may hold the key and, as with travel, vaccine status may reduce, but not remove, the need for tests or quarantine; it may inform the grade of PPE required; or it could be used to encourage pro-vaccine behaviours (in the US, Covid-19 rules for the traditional university spring break were recently relaxed for students who had been vaccinated, which naturally increased the take up amongst students).
‘No jab no job’ looks a little way off but it is not inconceivable that it would be appropriate once science and society have got to grips properly with what it means to be vaccinated and, indeed, not vaccinated.
Until then, we are all going to be feeling our way though some rather difficult legal and ethical issues (and I haven't even started on the data protection issues!).
At this time, our understanding is that a ‘vaccine passport’ is the card received by the individual when they receive a dose of their vaccine and details go in their medical records. This card provides proof of vaccination.
However, we are beginning to witness vaccine proof being demanded in certain situations – for example international travel and in certain circumstances, employment.
From a data protection and privacy perspective, the vaccine passport gives rise to a number of considerations. Data protection is a fundamental human right, founded on fairness and transparency, and is not a barrier to sharing information, where it is necessary and proportionate to do so.
Data protection law approaches any initiative that processes (uses) high volumes of personal information, and especially high-risk medical information, with these questions.
Vaccine passports also raise major ethical issues which, whilst not directly linked to data protection, do correlate with the protection of privacy. This issue arises as an unintended consequence of the passport, in that it automatically discriminates against those who do not have the vaccine for a variety of reasons, for example medical or religious reasons. The inference of not having a vaccine can be hugely discriminatory and prejudicial.
People need to be treated fairly and if the collection of vaccine information may have a negative consequence for an individual, the collection must be justifiable and proportionate to the need.
In the situation where a private company forces you to give them medical data before it will accept your business - is there precedent for this? Might this set precedents in other areas?
If the use of the vaccine passport personal information is likely to result in a high risk to individuals (e.g. denial of employment opportunities, denial of access to a service) then according to the Data Protection (Jersey) Law 2018 you need to complete a ‘data protection impact assessment.’
The implementation of a vaccine passport carries the clear risk of social inequality, causing a two-tier system, by creating barriers to people accessing public services. This issue strays into human rights. At this juncture it is timely to remember that data protection is a fundamental human right.
How can islanders minimise the obvious risks in complying with that, and make sure their health data is properly looked after?
All personal information is required by the law to be kept securely and confidentially. Health data is part of a group of personal information called special category data, which comes with increased requirements under the law as to its use and its security.
Can your employer collect personal information about whether you are vaccinated against covid-19?
Your employer must be very clear about what they are trying to achieve and how recording staff vaccination status will help achieve this. Whether you have been vaccinated is your private health information and is therefore special category data. Your use of this data must be fair, necessary and relevant for a specific purpose.
The reason for recording an employee’s vaccination status must be clear and compelling. If you have no specified use for this information and are recording it on a ‘just in case’ basis, or if you can achieve your goal without collecting this data, you are unlikely to be able to justify collecting it.
What questions should islanders consider when being asked to disclose personal information?
Islanders should always be very clear who is requesting their information, why and whom it will be shared with. This applies in all circumstances. A good starting point for individuals is to check out an organisation’s privacy policy, this document should be easy to find and easy to understand. The privacy policy should let you know who is using your information and what they will be doing with it.
The DPJL is based on several key principles – including the requirement for all users of personal information (businesses, charities, government etc.) to keep it accurate, to only retain it for as long as necessary and only use it for the purpose it was collected. The DP principles drive organisations to evaluate the personal information they use.
The first point is, are they actually going to happen? You hear the phrase ‘vaccine passport’ applied in the media to enable people to get into nightclubs and crowded events etc, but there’s a big push-back on this. Not least the fact that it’s the young people who have still not had their vaccines who would be discriminated against, and most likely to need them, apart from the individual’s right to refuse immunisation. I don’t think that will happen.
Where we are more likely to see a move is for travelling, and that’s because of countries, including Jersey, protecting their populations by protecting their borders. Even this argument isn’t completely clear cut, as although the evidence is growing that vaccines not only protect the individual but also other people because they’re far less likely to transmit the virus, the medics will need to decide if they are happy to allow the vaccinated to have free movement, or perhaps have fewer tests and isolation.
What might they look like?
It’s easy to think you have to have an app or QR code, but there might be simpler jurisdictional ways of dealing with this. In Jersey, any incoming travellers are already asked to fill in a form online with details of where they have been. This is so that the system can work out how long you need to isolate for, especially when we return to the Red, Amber, Green system.
If you also input your JY number, and that was linked to the Government’s vaccine data, then it could be a straight-forward way of verifying that Jersey residents are immunised, and so perhaps don’t need to self-isolate. For us that’s the simplest way of adding it to an existing process.
At the moment we should focus on connecting up our systems so that we can easily check our own residents. Our vaccination data is stored on EMIS, the GP’s record system, and accessing it would have to be compliant with GDPR and data security.
If vaccination data was safely extracted into the Integrated Public Health Record that was built for the Contact Tracing Team, and is a secure database and combines with the arrivals system, then that could address the issue for residents.
The next step would be to talk to the UK, as the bulk of other travellers come from there and see if we can link to an NHS number in the same way, and any UK vaccination databases.
What about those who want to travel out of Jersey to other countries, how do you deal with multiple jurisdictions and how does an airline access our personal data?
This is down to standardisation. Once the world opens up again, there will need to be an international standard. Each country is currently deciding what their requirements are. There are multiple layers of tech involved. First, where do you store the data, how do you allow the citizen to access and present that data, and how do you authenticate it? If something is valuable, then people are going to look to get around it and counterfeit it.
Regarding travel, I don’t think this will be down to individual airlines, they aren’t responsible now, they just communicate each jurisdiction’s requirements to passengers. Where we might see an international standard being established is through the International Air Transport Association, IATA.
If they want a mobile solution, then in my view, the only way we can get that is through Google and Apple, as they did with the contact tracing app, otherwise you will get multiple apps and no way of ensuring authenticity.
With contact tracing, they only allowed one approved app per public health jurisdiction. With our covid app we didn’t rush into developing our own, we waited to see if international standards would emerge, which they did when Apple and Google brought them out. The UK rushed into it with their first app, and it didn’t work.
The tough part is accessing the data. Each government is going to have to look at how they are verifying this and a trusted third party needs to bridge the gap between the health database and the end user, in a similar way that Yoti does with age verification via passports.
Vaccination passports are in reality only a real requirement if you have differing levels of immunisation around the world. As the vaccination programme rolls out and the statistically vulnerable are protected, the problem might just drop away. Everyone at the beginning of the pandemic thought that contact tracing mobile apps would solve everything; they ended up a nice to have, but not a panacea, instead just one weapon in the armoury. In reality, we need to sort our own system out first and try to work closely with the UK - they are our first line of defence to things like variants – then see what emerges as an international standard.
Comments
Comments on this story express the views of the commentator only, not Bailiwick Publishing. We are unable to guarantee the accuracy of any of those comments.