EDPB & EDPS adopt joint opinion on the extension of the EU Digital COVID Certificate Regulation

The EDPB and EDPS have adopted a joint opinion on the European Commission’s proposals to extend the current Regulations on the EU Digital COVID Certificate (EUDCC) by 12 months and to amend certain provisions, such as a broadening of the types of COVID tests accepted in the context of travels within the EU and clarifying that vaccination certificates should contain the number of doses administered to the holder, regardless of the Member State in which they have been administered. 

The EDPB and the EDPS take note that the proposal does not alter substantially the existing provisions of the Regulations with regard to the processing of personal data. In line with the previous joint opinion on the initial COVID Certificate Regulations, the EDPB and the EDPS recall that compliance with data protection rules does not constitute an obstacle for fighting the COVID-19 pandemic. Given the unpredictability of the possible prolongation of the pandemic, the EDPB and the EDPS understand the need to extend the applicability of the EUDCC Regulation.

However, since this proposal aims to extend the duration of a measure to fight the COVID-19 pandemic, the relevant scientific evidence and additional measures in place, should be regularly assessed to ensure the respect of general principles of effectiveness, necessity and proportionality. 

The EDPB and EDPS regret that no impact assessment was carried out by the Commission. In addition, the EUDCC Regulation provides for a duty for the EU Commission to submit a report to the European Parliament and the Council on the impact of the Regulation on the facilitation of free movement, fundamental rights and non-discrimination. The EDPB & EDPS strongly consider that the Commission should annex this report to the current proposal. 

EDPB Chair, Andrea Jelinek said: “These proposals are of particular importance due to their major impact on the protection of individuals’ rights and freedoms. Any restriction to the free movement of persons within the EU to limit the spread of COVID-19, including the requirement to present EU Digital COVID Certificates, should be lifted as soon as the epidemiological situation allows.” 

EDPS Supervisor, Wojciech Wiewiórowski said: “We need to continuously evaluate which measures remain effective, necessary and proportionate in the fight against the COVID-19 pandemic. Data protection principles should be continuously applied and integrated, having due regard to the evolution of the epidemiological situation and the impact on fundamental rights.”

The modification of certain fields of data, such as the clarification that vaccination certificates are to contain the number of doses administered to the holder or the proposal to make participants in clinical trials for the development of COVID-19 vaccines eligible for a COVID-19 vaccination certificate, seems to be limited to what is strictly necessary and does not raise particular concerns from a data protection perspective. However, the EDPB and EDPS recall their previous position that any modification of data fields might require a re-evaluation of the  risks to fundamental rights and that only more detailed data fields falling under the already defined categories of data should be added through the adoption of delegated acts. The EDPB and EDPS will continue to pay special attention to the evolution of the COVID-19 pandemic and, in  particular,  to  the  use  of  personal data following the end of the pandemic.