health passports, vaccination lists and their privacy risks

There is a big difference between have or not have the vaccine. But that information is personal. As more people receive it, we can gradually regain normalcy, but during this process, being (or not) vaccinated should not serve to discriminate, point out, pursue or differentiate ourselves.

In the middle there is a debate about allowing certain movements or being more flexible with those who are vaccinated. To establish this criterion, different organizations and governments are proposing vaccination lists and health passports. Lists and cards to specify who has received the vaccine. A few tools for which you are betting to recover the economy, but where health and privacy experts warn of the risk they pose to our privacy.

The autonomous communities begin to create lists and vaccination cards

In Andalusia, the Board raised a “covid card“without which one could not access events. Meanwhile, in Madrid The creation of a Covid card was announced, with an individual data sheet and the medical history of each patient.

In Murcia, the regional government sought a way to publish a list with all vaccinated people. Fernando López Miras, president of the Region of Murcia advocated for this, explaining that “we should do a good exercise of transparency so that there are no doubts about the health management that is carried out”. A list of vaccinated people who came to the prosecution, with encrypted data and a report from the Murcian Data Protection representative.

As reported The truth, the Ministry of Health has summoned five deputies to disclose the names of the approximately six hundred senior officials, officials and employees from the Ministry of Health who have already been vaccinated against Covid-19.

The own Data Protection reports commissioned by CCAA such as Murcia already indicate that the publication of the vaccinated should not be done without express consent.

The Murcian government itself commissioned a inform your Data Protection delegate. A document where it is alerted that the data can only be published with the consent of the vaccinated person, following article 9.2 of the RGPD. Although, the report opens a possibility:

“It could be studied by the data controller to provide statistical data unrelated to identity, which they consider to be of interest to citizens and that contribute to transparency”

In other words, the advisers themselves already indicate that the publication of vaccinated lists conflicts with Data Protection. Yes it would be more appropriate publication in more generic categories, as professional groups. In those cases, the anonymity of those vaccinated would be maintained, but it would serve to keep an account of the situation.

In the case of the Balearic Islands, Salud explained that it was not going to deliver the lists of people who have been vaccinated unless requested by a judge. Eugenia Carandell, director of the Health Assistance of the Servei de Salut, summed up thus: “we will not do it if a judge does not come to demand it because we do not have the legal capacity to do so.”

What does the RGPD say and where is the fundamental right to privacy?

The Spanish Society of Preventive Medicine, Public Health and Hygiene assures that these passports and serological cards inevitably lead us to “the stratified limitation of fundamental freedoms and rights for reasons of health and discrimination and stigma based on HIV status“Some health experts who believe that these measures could even” deter the population. ”

In a post in The Conversation, Josefa Cantero, professor of Administrative Law at the University of Castilla-La Mancha, and Ildefonso Hernández, professor of Preventive Medicine and Public Health at the Miguel Hernández University, state that “the mere requirement of a serological passport affects the fundamental right to privacy. To which is added that the fundamental right of freedom could be affected if the document were required to circulate. ”

Samuel Parra, a lawyer specialized in Data Protection, explains to Xataka that the Article 9 of the RGPD It already establishes that the processing of personal data, such as those related to health, is prohibited. While there is up to 10 different assumptions where they could be addressed.

The first one is when there is direct permission. If the vaccinated person gives permission, then clearly the list could be published. Other reasons that could intervene are if there is an “essential public interest” or if they are in the “public interest in the field of public health”.

This is what the specific section of the RGPD says about it:

“The treatment is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border threats to health, or to guarantee high levels of quality and safety of healthcare and medicines or medical devices, on the basis of Union or Member State law that establishes adequate and specific measures to protect the rights and freedoms of the interested party , in particular professional secrecy. “

Would this point be fulfilled in the case of these vaccination lists? Parra believes that if the Government of Spain makes a law to create these tools, the Constitutional Court would probably end up overthrowing it for conflicting with the fundamental right to privacy and for not be strictly necessary to protect public health.

Experts point out that the fundamental right to privacy is at risk and there are not enough health reasons to justify this interference.

“If there is no consent, a law is required that allows dissemination,” explains the lawyer. But it also states that these data require a bonus of additional guarantees. If a law is approved by the Government, the Constitutional Court could end up challenging it if it values ​​that the right to data protection prevails. Under what criteria? As Parra points out: “It does not affect my health to know if that man has been vaccinated or not”.

From Xataka we have consulted the Spanish Agency for Data Protection to find out its official position regarding health passports and vaccination lists. At the moment no answer. The same agency has been consulted by the Murcia region to find out if they could proceed to the publication of the list of vaccinated.

Is a health passport necessary to travel?


Government trust in the vaccination record to be able to travel. Own European Union prepares a common framework to create a vaccination certificate standard. A certificate that, according to the Commission itself, must be in a “framework of adequate trust that guarantees privacy and security”. How it will work or what it will be required for is not specified.

The European Union itself prepares a vaccination certificate, but it is not clear when it can be requested or who will have access to information on whether we are vaccinated.

In the event of a European law for vaccination certificates, it would be the European Court of Justice that could end up annulling it. A fact that has already occurred in the past with the telecommunications directive, in relation to saving the numbers of the people who are called. In that case, nine years after it was put into practice, the directive was annulled.

“It would be necessary to see how they articulate that information. But I don’t think it was legal for airlines to ask you or check if you are vaccinated“, explains Parra. Another case would be if this certificate was only shown at the time of boarding, equivalent to what is done with the PCR. In that case, there would be no impact on Data Protection rights.

Image | Bill Oxford

Source: Xataka by

*The article has been translated based on the content of Xataka by If there is any problem regarding the content, copyright, please leave a report below the article. We will try to process as quickly as possible to protect the rights of the author. Thank you very much!

*We just want readers to access information more quickly and easily with other multilingual content, instead of information only available in a certain language.

*We always respect the copyright of the content of the author and always include the original link of the source article.If the author disagrees, just leave the report below the article, the article will be edited or deleted at the request of the author. Thanks very much! Best regards!