Under a section titled “What is the purpose for the processing of personal data” the notice states: “As the country resumes normal functions, this data will be useful for further aspects of unlocking as they arise, e.g for international travel or attendance at domestic events once these have been permitted by government policy and guidance.”
However government officials working on a review into the use of Covid certification have told The Telegraph there is no chance the passports will be used within the UK.
“It’s not a case of ‘it’s finely balanced’. It’s not going to happen. Everyone says it’s dead,” one source told the newspaper.
Ministers are currently reviewing data to determine whether all Covid restrictions can be lifted by June 21, which would include further international travel and a return to clubs and bigger events.
Eerke Boiten, professor in cyber security at De Montfort University in Leicester, said using the passports for anything wider that international travel poses surveillance risks. He called for a full data protection impact assessment (DPIA) to be completed before the purpose of the passport is widened.
“My main remaining concern is the lack of a DPIA – the lack of a DPIA has become more relevant because they are widening the purpose of the whole thing,” he told Digital Health News.
“If you go into the system [NHS App] it is a vaccination passport for international travel, but when you look at the privacy notice it’s also something to keep disease in control as part of the general unlocking of day to day life, and that’s worrying.
“There’s explicit mention of events that this might be used for, and I don’t think there’s anything that actually restricts the use of this or would stop the government from widening its application to other areas.”
Boiten reiterated previous calls for the passports to be linked to an identity verification process, such as QR codes, to avoid abuse of the system.
Writing for The Conversation Boiten raised concerns about the wider use of Covid passports resulting in discrimination.
“International travel was merely an example of how the data would be used. Here lie significant problems that critics have been concerned about for some time. For one, the broader use of vaccine passports raises issues of discrimination between those who have and have not been offered vaccinations,” he wrote.
“But using vaccine passports in scenarios other than international travel also necessarily increases surveillance, seeing as you’ll need to prove that the vaccine certificate on your phone truly belongs to you.
“When we travel internationally, we’re used to carrying a passport along with flight tickets and required vaccination certificates – but for events and social gatherings, we don’t expect to have to identify ourselves.”
“Worryingly sensitive” data collection
The policy contained a “long and confusing” list of personal data that is collected a part of the passport service including ethnicity, vehicle registration, national insurance number, employer and criminal convictions.
The policy has since been updated to confirm it only collects information including full name, date of birth, NHS number, home address, phone numbers and email address.
Since Covid-19 passports were announced the NHS App has been downloaded more than one million times. The app now has 4.8 million registered users, of which 1.3m are new users of the app.
To find out more about Covid-19 passports and how they will work, you can read our explainer here.