Are non-profit vaccine passports the key to preserving privacy?

by Rina Chandran | @rinachandran | Thomson Reuters Foundation
Tuesday, 27 April 2021 11:20 GMT

Travelers queue in a security line limited to every other lane for social distancing at Seattle-Tacoma International Airport in SeaTac, Washington, U.S. April 12, 2021. REUTERS/Lindsey Wasson

Image Caption and Rights Information

Vaccine passports built by non-profits may assuage some privacy concerns, but the underlying problem of access remains

By Rina Chandran

April 27 (Thomson Reuters Foundation) – Israel has one. France is testing one, while Qantas has said one will be necessary for overseas travel.

Across the world, as inoculations roll out, governments and corporations are unveiling vaccine passports to restart events, and reopen businesses and borders by identifying those who are protected against the virus.

Digital vaccine passports that can be managed on a mobile app are a popular choice not just for travel, but increasingly for work and entry to bars, cinemas and other social activities.

But rights experts say they exclude marginalised groups, and raise risks of greater surveillance and loss of privacy.

Amid the rash of big technology companies including IBM, Oracle and Microsoft that are developing digital passports, is a handful of non-profits who say their vaccine passes can preserve privacy and are more inclusive.

"Not every tech solution should be controlled by big tech," said Jennifer Zhu Scott, executive chairman of The Commons Project, a non-profit that has partnered with the World Economic Forum to develop a mobile app to show vaccine status.

"We can take this global crisis and make data ownership more inclusive if we can provide privacy-preserving solutions for people. Those are the best technologies that we can put into someone's hands," she told the Thomson Reuters Foundation.

Vaccine passports have been around in some form for a while, from certificates for smallpox vaccinations in the 1800s to evidence of shots for diphtheria and whooping cough, and the "yellow card" for proof of inoculation against yellow fever.

These were generally paper certificates stamped by doctors. Vaccine passports for COVID-19 are often mobile apps that contain more personal details of the individual, their vaccination status and vaccine dosage.

The Commons Project's CommonPass, which is free to download, allows individuals to access their lab result and vaccination record, and requires their consent to have that information validate their COVID-19 status without revealing any other underlying health information at the same time.

Several airlines including Lufthansa, Qantas and Cathay Pacific are using or testing CommonPass. The Commons Project is also talking to dozens of governments, said Scott.

"Perhaps at the end of the pandemic, we can look back and say: we returned some of the data ownership to individuals," she said. 


With more than 3.1 million deaths worldwide, the coronavirus pandemic has hurt poorer populations and economies most.

Vaccines remain unequally distributed, with more than 80% of the nearly 1 billion doses administered so far having gone to high- or upper middle-income countries, while low-income countries have received just 0.3%, according to the WHO. 

These inequities will be replicated in vaccine passports, with marginalised people denied access to public, private and professional spaces because they cannot or chose not to be vaccinated, said Joan Mukogosi, a research assistant at Data & Society, a thinktank.

"Since national and international inequities in access to vaccines are occurring along racial and economic lines, vaccine passports are poised to be a marker of privilege of vaccination, rather than a simple signifier of immunity," she said.

In addition, vulnerable groups like undocumented people may be unable to use vaccine passports even if they are vaccinated, "for fear of their movements being logged or tracked," she said.

A paper-based credential from the non-profit PathCheck Foundation at the Massachusetts Institute of Technology, allows for more equitable access as it does not require digital literacy or the use of additional devices, according to director Vitor Pamplona.

QR codes containing vaccination status and minimal personal information are placed in a trifold card that "not only blocks unauthorised readers from even seeing the QR, but also requires users to actively choose what to share in each interaction," he said.

"By not even collecting data at any central point, PathCheck breaks the usual personally identifiable data flows that are already out there. It's by far the most privacy-conscious design," he added.

This will be increasingly relevant - and problematic - as immunisation records contain enough information to connect individual records to vaccination information to "every other dataset you can imagine, from tax records to Twitter posts," Pamplona said.

But while vaccine credentials built by non-profits can assuage some privacy concerns and maximise user control, people who have been marginalised before and during the pandemic will still be disproportionately denied access, said Mukogosi.

"The underlying problem presented by vaccine passports - dictating entry into private and public space - remains," she said.

"Put simply, if we want vaccine passports to be equitable, we must vaccinate equitably."


Coronavirus passports: what you need to know

Back to work? Not without a check-in app, immunity passport

What role for vaccine passports in coronavirus fight?   

(Reporting by Rina Chandran in Bangkok @rinachandran; Editing by Tom Finn. Please credit the Thomson Reuters Foundation, the charitable arm of Thomson Reuters, that covers the lives of people around the world who struggle to live freely or fairly. Visit