OMMDAC has responded to a call for evidence from the UK government, which is reviewing whether COVID-status certification could play a role in reopening the economy, reducing restrictions on social contact and improving safety.
The Observatory’s response covers specific considerations associated with COVID-status certification, and fundamental issues related to data quality, access, and disclosure.
- This submission reflects the initial findings of the AHRC-funded Observatory for Monitoring Data-Driven Approaches to Covid-19 (OMDDAC) based on interdisciplinary interview-based research.
- Our project interviews raised concerns that certification risks becoming a ‘surrogate for discrimination’ leading to ‘coercion by the backdoor’, with an individual’s ‘medical status becom[ing] publicly interrogable.’ Furthermore, there are equality issues such as digital poverty to consider in the technological response. Local knowledge has been fundamental to overcoming testing and vaccination concerns within local communities.
- Lessons learned from the data-driven response to the pandemic to date indicate fundamental issues around the underlying data itself, firstly in terms of the sharing or disclosure of the required data to enable local bodies to manage an appropriate local response, and secondly in relation to the quality of the data.
- The following fundamental concerns must be addressed in advance: who must be provided with access to the data to enable the required response; what data needs to be provided and in what format; and crucially what specific purpose would the sharing of this data be seeking to achieve? These issues are still to be addressed satisfactorily.
- It will be crucial to clarify the role of policing and enforcement in relation to any proposed vaccine certification or ‘passport’ to prevent an erosion of public trust in the scheme.
This response is submitted on behalf of the AHRC-funded ‘Observatory for Monitoring Data-Driven Approaches to COVID-19’ (OMDDAC). OMDDAC is a collaboration between Northumbria University and the Royal United Services Institute (RUSI), researching the data-driven approaches to Covid-19, with a focus upon legal, ethical, policy and operational challenges. OMDDAC analyses key data-driven responses to Covid-19 and collates lessons learned throughout the pandemic by way of stakeholder interviews, case study analysis, representative public surveys, and practitioner-focussed guidelines.
The evidence presented in this contribution has been collected primarily through interviews with key stakeholders from a range of sectors (including data organisations, local and central government, regulators, law enforcement, the medical profession, the legal profession, charities and the third sector, the private sector, and an inter-disciplinary range of academics) for the purposes of OMDDAC’s research. In this response, we use this interview data to identify lessons which have been learned by stakeholders and can be applied to future data-driven responses, including a certification scheme.
Specific considerations associated with a potential COVID-status certification scheme
As outlined by this call for views, a COVID-status certification scheme includes both vaccine and testing data. The current coupling of both vaccination and test results to identify an individual as ‘covid-safe’ could require a technological approach. This technology would be used to deny or allow entry to venues. In order to work, the technology would need to be supported by digital infrastructure that can a) maintain the identity of an individual b) be able to book and submit testing information c) support a digital fingerprint (for example QR code) that is enabled once they are tested and receive a negative result. This would need to complement the requirements for a ‘vaccination passport’ as defined by the Ada Lovelace Institute.1 The current NHS Test and Trace app maintains features similar to these requirements, but is not used at the moment to deny or permit entry into venues.
The use of technology to then permit or deny entry into venues raises significant ethical challenges. In our stakeholder interviews, we found that experts were most concerned about the certification becoming a ‘surrogate for discrimination’. At the moment, ‘young people’ (18–29-year-olds) are currently scheduled to receive a vaccination by 31st July (end of Phase 2 of the vaccine rollout). Our stakeholders raised the concern that if workplaces were to request ‘covid-safe’ certifications to either get a job or return to the workplace, this could lead to ‘indirect discrimination’. Furthermore, there are remaining questions of how much the process will be outsourced to the private sector, without being guided by human rights obligations, according to one interviewee. One proposed method of instilling oversight is through the Equality Act 2010. This would benefit from further amendment requiring oversight to account for factors such as poverty. Moreover, in a technology-driven approach, digital poverty and what that may mean for the efficacy of any certification technology will need close assessment.2
Our research has also revealed that ‘coercion by the backdoor’ is a key concern with certifications for people of all ages, regardless of how quickly age groups are vaccinated. Relatedly, one interviewee raised concerns about their application without scrutiny and what can be perceived as an ‘unjustified intrusion’, particularly as the status of vaccination is a personal choice with private reasoning. By revealing the status of vaccination an individual’s ‘medical status becomes publicly interrogable’. The benefits for businesses are apparent – a certificate can fast track people back into the office with less caution than waiting for tests. Nonetheless, the interviewee argued that a certification will result in vaccinated people being treated differently from those who have not been vaccinated.
Local and qualitative knowledge was emphasised by our interviewees as being crucial to the understanding of the take-up of both tests and vaccinations, for instance knowledge around the location of testing and vaccination centres by reference to areas of deprivation, and community-based knowledge around concerns within particular communities.
One interviewee suggested that the application of the certificate to gain entry could be determined by separating venues between obligatory (for example place of work) and voluntary (travel, music venues, sporting venues). For voluntary venues, a certificate would be required to gain entry or travel. Obligatory venues such as workplaces (except for specific situations like working in a clinical environment) should use vaccination certificates to gain entry. The design to include negative test results could bypass this model as it would not be dependent on vaccination status, but both vaccination status and negative test results.
Fundamental issues of data quality and access/disclosure
Before analysing the specific issues raised by the introduction of a COVID-status certification scheme, significant consideration should be afforded to fundamental issues in relation to the underlying data itself, firstly in terms of the sharing or disclosure of this data and secondly in relation to the quality of the data. In this regard, several lessons can be learned from the findings of our interviews with key stakeholders, in particular the challenges that have been faced in gaining access to and effectively utilising centralised datasets to identify and respond to vulnerability within the local community.
Access issues: there appears to have been consistency in the difficulties experienced by several stakeholders in gaining access to centralised data sets, which have proved to be of fundamental importance in enabling a localised response to the pandemic. A ‘lack of trust and lack of coordination and sharing from central government and NHS to local authorities’ has been observed by multiple stakeholders. According to one local government representative, describing a critical period towards the beginning of the pandemic:
We just could not get access to the data. There were lots of blockages, lots of arguments […] and it took forever for them to start giving us some data and it still wasn’t enough. They weren’t giving us specific houses or people, it was just aggregated data showing geographical hotspots that we would have guessed anyway. They were not giving us the detail, for a time, to do anything with
In relation to enforcement, clarity on whether the police will have access to further medical data associated with vaccination certification will be important in ensuring public trust. It is possible that vaccination status will form an additional piece of information that the police can request from NHS Test and Trace when they are investigating reports of individual breaches of self-isolation under the ‘The Health Protection (Coronavirus, Restrictions) (All Tiers and Self-Isolation) (England) (Amendment) Regulations 20’. If this is to be the case, then clear guidelines around the circumstances in which police may request vaccination data, including whether it is necessary and proportionate to the supposed offence, must be laid out. At the time of writing, the Memorandum of Understanding between the Department of Health and Social Care and the National Police Chiefs’ Council regarding police access to individual-level Test and Trace data has still not been published – any upcoming publication should include mention of how vaccination status will be covered in this information sharing agreement.
Our stakeholders commonly raised concerns around the quality of data and whether it enabled the identification of vulnerable groups. The COVID-status certification review should therefore bear these fundamental operational challenges in mind in relation to the underlying data which will be used to operationalise any such certification scheme. Detailed consideration should be given at the outset to questions such as: who needs to be given access to the data to enable the response; what data must be provided; what form must the data provided in, and, most fundamentally, what specific purpose would the sharing of this data be seeking to achieve? As observed by one stakeholder:
It is crucial to have a clear understanding of what the problem is that you are trying to fix.
 For the purposes of this contribution the definition of ‘vaccination certificates or passports will replicate the definition provided by The Ada Lovelace Institute’s Rapid Expert Deliberation. The Ada Lovelace Institute, in their rapid expert deliberation, defines ‘vaccine passports’ as containing ‘health information (vaccine status through e.g. a certificate), verification of identity (connecting the holder to that certificate) and authorisation for the purpose of allowing or blocking actions (a pass)’. https://www.adalovelaceinstitute.org/summary/covid-19-vaccine-passports/
 For further information see University of Cambridge, Hannah Holmes and Dr Gemma Burgess, [https://www.cam.ac.uk/stories/digitaldivide#:~:text=As%20an%20aspect%20of%20deprivation,income%20of%20over%20%C2%A340%2C001]