Vaccine Passports: A Stamp of Inequity

A COVID vaccine has been approved and vaccinations have begun. With them have come proposals of ways to prove you have been vaccinated, based on the presumption that vaccination renders a person immune and unable to spread the virus. The latter is unclear. It also raises digital rights concerns, particularly if you look at the history of healthcare access, and consider how it maps onto current proposals to digitize and streamline “vaccination passports” for travel.

We must make sure that, in our scramble to reopen the economy, we do not overlook inequity of access to the vaccine; how personal health data in newly minted digital systems operate as gatekeepers to workplaces, schools, and other spaces; and the potential that today’s vaccine passport will act as a catalyst toward tomorrow’s system of national digital identification that can be used to systematically collect and store our personal information.

We have already witnessed problems with COVID-19 testing and its intersection with digital rights. Some individuals weren’t able to access testing simply because they did not have access to a vehicle. The digital divide emerged in places like San Francisco’s Tenderloin district, one of the city’s poorest neighborhoods, where many weren't able to access testing because they did not have a smartphone. The danger of further social inequity is just one reason why we opposed a since-vetoed bill in California that proposed to create a blockchain-based system of verifiable credentials for medical test results, including COVID-19 antibody tests. We must draw on the lessons from the recent past and earlier vaccination efforts as we go forward.

Current Proposals

EFF is focused on proposals to distribute these vaccination credentials digitally. While paper-based credentials are possible, too, most proposed plans involve digital implementations. In fact, some companies already have digital passport systems. CLEAR is rolling out a HealthPass that logs testing or vaccination status. This company provides pre-flight screening in major airports around the country. Ticketmaster has considered partnering with CLEAR for another “Health Pass.” Such partnerships could lead to another intertwined network of unprecedented sharing of personal information, similar to issues we have currently with data brokers and advertising information.

Some have suggested using  W3C’s (The Worldwide Web Consortium) Verified Credentials and Digital Identifier specifications as a potential way to standardize vaccination passports. However, this standard does not tend to solve the equity issues of unequal access to vaccination and digital technologies. They are also not exempt from attacks that can potentially leak data.

Advocates of digital systems have suggested they would address the fraud and forgery concerns raised by paper-based credentials. Proposals like CommonPass—which notifies users of local travel rules and attempts to verify that airline passengers are complying with those rules—are designed to face this issue head on. Informing users of local information is a great feature. However, these systems do little to address the more prevalent