“Anytime and anywhere”: Vaccination passports, immunity certificates, and the permanent pandemic

As we see Covid-19 vaccination programmes beginning around the world, for the first time since the start of the pandemic there seems to be a light at the end of the tunnel as the fruition of truly unrivalled global scientific efforts has given us hope of saving lives, reopening our societies, and going back to “normal”.

This great moment of hope must not be seen opportunistically as yet another data grab. The deployment of vaccines, and in particular any “immunity passport” or certificate linked to the vaccination, must respect human rights. As we’ve had to remind governments repeatedly over the last 10 months, and 30 years, such stealth opportunism by governments and companies will undermine trust and confidence, particularly at this time when they’re needed more than ever. Otherwise these incredible efforts will have been in vain. Until everyone has access to an effective vaccine, any system requiring a passport for entry or service will be unfair.

We are on the verge of one of the largest healthcare distribution programmes in human history. It needs resources, it needs logistics, it needs coordination. It will be hard. It must be fair. And it must protect us and our rights.

Vaccination records are probably necessary, but open a can of worms

In a sense, vaccination records are simple. In its simplest form, it’s the issuing of a credential to someone as they are vaccinated. This could even help us keep track of the vaccination process, particularly if there are two doses required. In that specific case, it could help the health provider know which vaccine to issue to someone, and when.

Considering the spread and scale of vaccination required, however, issuing this paperwork is non-trivial. And to what degree does this documentation need to be trusted to be reviewed by other providers? And who else will want access? That is where things get more complicated. And that’s where ambitions lie.

Who wants access to these ‘passports’?

As we deploy vaccination and reopen our economies, there are some who see the ‘passport’ as a necessary tool. The airline industry has said they want to be able to verify the certificates before people can travel. Employers may require it - particularly if your job involves working in confined spaces or with the public. Governments may require it to access some services (healthcare or schools), places (public events and sporting events), and at checkpoints and borders.

We can’t be clearer on this point: until everyone has access to an effective vaccine, any system requiring a passport for entry or service will be unfair. The vaccine is a public health exercise, and must not be a new discriminator.

It’s not like with the hundreds of different types of contact tracing apps out there, or various mask policies - things governments were too shy to make mandatory, instead choosing to push onto businesses as a prerequisite to reopening. Most people could afford a mask and for most it wasn’t a burden; and eventually, after pressure, most apps would work on most smartphones, though excluded those without the right smartphones - again, often leaving it to businesses to collect details manually.

Once you have ‘uses’, you have ‘users’

The vaccination record helps you keep track; and could help your health provider keep track. But once being vaccinated becomes a requirement, so does others’ need to verify this record. That’s when it becomes a pass. And that’s when it becomes an identity document. And once you have multiple uses (e.g. access to services) in multiple domains (i.e. public sector, private sector), in multiple countries (i.e. travel), then we are approaching a global identity document needed to live your life.

In contexts where an identity scheme is already in place, i.e. passports for international travel, tying a vaccination requirement may be argued as being less problematic, as it would functionally be similar to the WHO’s Carte Jaune showing Yellow Fever vaccination being mandatory for entry to certain countries. And yet, concerns remain even here that lack of access to the vaccine will mean that the freedom of movement - especially internationally - will be severely curtailed for many people, for many years.

And let’s not forget the issuance of that yellow fever certificate is an optional add-on to the actual public health exercise; magnitudes more people are vaccinated for yellow fever than have the certificate proving it, since the certificate is only useful in limited, specific circumstances. If the holding of a covid-vaccination certificate is used to reopen our societies, however, the issuance of a certificate will be as necessary as the vaccination itself, if it is be used across our lives. And the cost of the system will necessarily grow. And the speed of deployment will be slowed.

In contexts where identification and associated requirements such as vaccination were never in place, such as internal national travel, access to your workplace, to go into a public place like a park or restaurant, or to go to school, this is where the implications can become severe depending on the context, and particularly if the different scenarios we’ve seen play out in other situations such as mission creep, exclusion and surveillance are not carefully considered and taken into account as decisions are made.

And given our societies are all interconnected it is likely that international data sharing of health data will become the norm beyond the purpose of international travel and public health management.

Which brings up a question about for how long?

Covid Immunity as a justification for expanding or instating digital identity schemes

Tying the vaccine to “immunity passports” or other identity schemes will reinforce and further entrench existing inequalities and exclusions, creating a state of permanent pandemic for these groups. As PI has pointed out, tracking and tracing of cases is poor, particularly affecting those in vulnerable populations.

Be under no illusion - this isn’t just the work of individual governments; we continue to see concerning developments on the international stage, with the recent pushes to global digital identity schemes such as the World Bank’s ID4D programme. Alan Gelb and Anit Mukherjee of the Centre for Global Development, itself a key driver - and strong proponent - of identity schemes being rolled out across the globe, call for the development of a digital “credential that can serve as an on-demand proof of vaccination for both international travel and large domestic gatherings — anytime and anywhere”.

We highlighted the challenges of such a system back in July 2020:

Immunity passports brings together the worlds of identity and public health. While the goal may be to have an immunity passport system that is available to everyone, in practice this will likely be far from the case.

We’ve covered previously how patterns of historical exclusion are reflected in identity systems and the modern realities. It would be unprecedented for a combined system for identity and health system to not unfairly target or exclude people.

Health systems already exclude many people, or create unintentional hierarchies in society. Access to testing or a future vaccine will most likely follow the existing patterns of exclusion. Similarly, groups that look to avoid contact with the state will fear the uses to which their data may be put.

Public health and identity systems are a potentially toxic mix

This is why it is even more concerning when a country like India (whose digital identity system, Aadhaar, has been associated with human rights violations and security concerns), is being held up as an example, where “[e]ach person in the [Covid-19] immunisation list [will] be linked with their Aadhaar cards to avoid duplication and to track beneficiaries”.

Furthermore in the context of health, the casual linking of services to ID schemes or biometrics is highly problematic, and of huge concern. For instance, in Kenya, a scheme to link HIV/AIDS treatment to biometrics was stopped only when the affected populations were able to campaign and be heard. They were concerned about “mission creep” - that the data would be used for other purposes - as well as the risks of data breaches. Similarly in India, there are reports that some stopped looking for treatment for HIV/AIDS after treatment was linked to the biometric identity system Aadhaar.

There are also the existing concerns around ID being a pre-condition for accessing healthcare. We are not alone on this point; this is why the UN Special Rapporteur on Extreme Poverty and Human Rights questioned existing mandatory ID requirements for accessing health care services.

Public health programmes should be focused on inclusion, not threatening exclusion.

Function creep towards comprehensive ID systems

We have also expressed our deep concern with the “function creep” aspect of “immunity certificates”: how it becomes a segue to the more general rollout of digital ID, or for new applications such as in sectors of “law enforcement”, counter-terrorism and immigration enforcement. This, in the context of a Covid-19 pandemic, is a way of short-cutting public debate and considerations about the developments of these schemes. As we wrote back in July:

The danger … is that, if we had an immunity passport system that is being used by a significant proportion of the population, after the crisis - it becomes a more general digital identity for people, by default and through inertia.

But that would be dangerous: the middle of a crisis is not the time for the necessary processes of deliberation and debate, policy and regulatory scrutiny, civil society and public participation, and careful establishment of system specifications and requirements.

But for the proponents of digital identity, this function creep isn’t a bug, it’s a feature. As Gelb and Mukherjee write: “On the positive side, a COVID ID can set the foundation for a population-wide digital health ID that, over time, could be used to provide better health services, both public and private, including other immunization outcomes. It could also be linked to other digital services, including cash transfers to incentivize take-up of the vaccine if necessary.”

The obstacles to effective public health are not resolved with an identifier. In fact, they can be exacerbated. We need both a more human and a more realistic approach rather than be caught up in idealistic, opportunistic, and ambitious crusades to record and document everyone.

The broader human rights, ethical and societal implications

As we noted earlier in this piece, immunity passports and what they are evolving to be have broader human rights, ethical and societal implications.

As already highlighted by a piece in the Lancet Journal back in May 2020: “Immunity passports would impose an artificial restriction on who can and cannot participate in social, civic, and economic activities and might create a perverse incentive for individuals to seek out infection, especially people who are unable to afford a period of workforce exclusion, compounding existing gender, race, ethnicity, and nationality inequities. Such behaviour would pose a health risk not only to these individuals but also to the people they come into contact with.”

And this warning is becoming a reality given it is now clear that not all will be vaccinated, and some will have to wait years to get them.

So, what happens in the meantime to those individuals and populations?

In countries where mass testing is underway, proof of a negative Covid test may continue to enable the unvaccinated to enjoy the same, or similar, benefits as those vaccinated. But we don’t know how long this will continue to be the case once vaccination documents become the only recognised “free pass”, as has been declared by some private firms already. From what we’ve seen it won’t be long until this becomes the default for other public and private bodies as they review how their interaction with individuals is regulated and managed.

Using “vaccination certificates” as a trojan horse to spread digital identity schemes endangers public health.

We know that identity systems exclude people, with individuals and communities unable to access these services, and this exclusion will be compounded by exclusion from vaccination schemes.

And this is not only exclusionary for communities that do not have access - endangering the health of some of the most vulnerable - it also goes against the broader public health benefits of vaccination: leaving large populations unvaccinated will mean that the virus remains a public health threat.

The Covid-19 pandemic has shown up local, national, and global inequalities. But we can, with the promise of vaccination of those most at risk, begin to see the end of the pandemic in sight… but the cost of this must not be the roll-out of inappropriate and exclusionary digital ID that will make these inequalities permanent and entrenched in law.

Instead, countries must implement an effective test, track, trace, isolate regime, focusing on removing the channels of the spread of infection so that we can begin to unlock our communities again, without the devastating, lasting consequences of a digital ID scheme. Governments must find alternatives to delivering vaccination schemes which do not perpetuate and reinforce exclusionary and discriminatory practices and policies which are already well-documented and which in a socio-economic and political crisis have the potential to create even more lasting harm.