Canada must build safeguards into COVID vaccine passports

The question of whether Canada should create COVID-19 vaccine passports was answered by Health Minister Patty Hajdu when she confirmed the federal government will create such a system so Canadians can travel internationally again.

Now is the time to consider who in Canada will provide such passports, and how they should be designed and deployed.

Vaccine passports of one design or another are already in use in several countries and regions around the world, including Israel, Denmark, China, Mexico and Lebanon. The European Union is developing one. So is the U.K. New York has its own system. In these and other places, vaccine passports are helping bring life back to normal, while facilitating domestic and international travel.

For all these benefits, there are good reasons for Canadians to be concerned about the privacy impacts of vaccine passports. History teaches us that measures enacted to respond to emergencies are often “sticky.” Income tax was introduced as a temporary measure during the First World War, yet millions of Canadians have filed their annual returns.

Correspondingly, privacy campaigners have expressed concerns that a passport system used to check our vaccination status before entering a store or a concert venue during COVID-19 times could form the backbone of a long-lasting system of location-based surveillance.

These are legitimate concerns, but our research makes clear that choices can be made in the design characteristics of a vaccine passport system and the rules governing their use to avert them. We can make a vaccine passport that maximizes public health benefits, while minimizing privacy and other human rights impacts.

To do this, several critical questions need to be addressed at the outset.

First, who should be permitted to issue vaccination passports?

The private sector is taking the lead in many countries and regions. If governments in Canada don’t act, likely the private sector will introduce vaccine passports here, too, raising a host of worries relating to equity, discrimination and privacy. If we want access to vaccine passports for all who qualify, governments need to issue passports themselves or regulate the incipient market in vaccine passports.

Second, what information should vaccine passports include?

Concerns that vaccine passports could be used to track our movements are very real. But to do so, vaccine passports would need to encode information about our identity — like our name or a unique identifier, like our Social Insurance Number (SIN). As a matter of principle, vaccine passports should collect as little information about us as possible, possibly not even containing our names. This is known as “data minimization.”

Finally, what technological form will the passports take?

Most proposals call for digital passports as scannable QR codes or an app on your phone. But digital systems make it easy to collect and store data about the use of vaccine passports — forever. By contrast, paper-based systems could be better at protecting privacy. Flashing a paper-based passport at a security guard does not risk creating the permanent data trail that scanning a digital credential might. Yet it may be possible to develop a digital passport system that leverages the technologies found in contact-tracing apps to help protect our privacy.

We should also consider who can ask to see your vaccine passport, how vaccine passports will be verified and validated when they are presented to gain access to a place or a service, and what information can be collected and stored whenever a passport holder is required to show it.

Good policy can mitigate privacy concerns in each case. For example, governments could mandate that entities that are permitted to inspect the vaccine passport may simply verify the information encoded into the passport without retaining it for any purpose.

Vaccine passports will, of course, be opposed by some on principled grounds. We believe, however, that social justice is best advanced by ending the pandemic and restoring normal life as quickly as possible. If vaccine passports can help do that, then we should call upon our governments to put systems in place with sufficient safeguards for important values, like privacy.

Colleen M. Flood is a University of Ottawa research chair in health law and policy, and part of a research team funded by the federal COVID-19 Immunity Task Force.

Vivek Krishnamurthy is the Samuelson-Glushko professor of law at the University of Ottawa and a fellow at the Carr Center for Human Rights Policy at the Harvard Kennedy School. He is also part of a research team funded by the federal COVID-19 Immunity Task Force.