Questions and Answers – EU Digital COVID Certificate

The EU Digital COVID Certificate (formerly called Digital Green Certificate) will facilitate safe free movement during the COVID-19 pandemic within the EU. It will serve as proof that a person was vaccinated against COVID-19, received a negative test result or recovered from COVID-19. The certificate can be used across all EU Member States as well as in Iceland, Liechtenstein and Norway. Contacts are also ongoing to enable its use with Switzerland. The Commission is working to make sure that the certificates can be compatible with systems in other countries outside the EU.

What are the main elements of the agreed EU Digital COVID Certificate?

• The EU Digital COVID Certificate system covers three different types of COVID-19 certificates: a vaccination certificate, a test certificate, and a certificate of recovery.
• The EU Certificate can be issued and used in all EU Member States to facilitate free movement during the COVID-19 pandemic. All EU citizens and their family members, as well as non-EU nationals legally staying or residing in the Member States and who have the right to travel to other Member States, would be eligible to receive such certificates free of charge.
• The EU certificate only includes a minimum set of information necessary to confirm and verify the holder’s vaccination, testing or recovery status.
• Being vaccinated will not be a pre-condition to travel. All EU citizens have a fundamental right to free movement in the EU and this applies regardless of whether they are vaccinated or not.

1. The EU Digital COVID Certificate – free movement

How will the EU Digital COVID Certificate facilitate safe free movement?

Member States shall refrain from imposing additional travel restrictions on the holders of an EU Digital COVID Certificate, unless they are necessary and proportionate to safeguard public health. In such a case, the Member State must inform the Commission and all other Member States in a timely manner and provide reasons for such new measures.

The EU Digital COVID Certificate will serve as proof of vaccination, testing and recovery, which can be used across all EU Member States. When travelling, every EU Digital COVID Certificate holder will have the same rights as citizens of the visited Member State who were vaccinated, tested or recovered from COVID-19.

On 31 May, the Commission proposed to update the Council Recommendation on the coordination of free movement restrictions in the EU, setting out clear rules on the conditions to lift travel restrictions to persons who are holders of the EU Digital COVID Certificate.

How do you ensure that non-vaccinated people are not discriminated when exercising their right to free movement?

To ensure that the right to free movement in the EU is respected and that there is no discrimination against individuals who are not vaccinated, the EU Digital COVID Certificate will cover COVID-19 vaccination certificates, test certificates, and certificates for persons who have recovered from COVID-19. In this way, as many persons as possible will be able to benefit from an EU Digital COVID Certificate when travelling.

The aim of the EU Digital COVID Certificate is to facilitate free movement inside the EU. It is not be a pre-condition to travel. The EU Digital COVID Certificate is not a travel document. Persons who are not vaccinated must be able to exercise their free movement rights the same way as those who are vaccinated, where necessary subject to limitations such as testing or quarantine/self-isolation.

What is the role of the Commission and what is the role of Member States?

All Member States must provide digital solutions for the issuance of the EU Digital COVID Certificate free of charge. This includes:

• An app or portal for issuing both digital and paper certificates
• A solution for citizens to store them (for example wallet app, existing tracing app)
• A scanning solution for verification (with a smartphone using an app, for example).

To facilitate this work, the Commission is offering open-source reference software and apps for the issuance, storage and verification of certificates. These were produced for the Commission by SAP and T-Systems. However, Member States can also develop their own apps or use existing storage apps. The technical specifications were agreed by Member States on 21 April in the eHealth network.

2. EU Digital COVID Certificate – how it will work in practice?

When will the EU Digital COVID Certificate be ready for use?

The certificate will be introduced in EU Member States. Countries can start issuing and using already and it will become available in all EU Member States as of 1 July. If a Member State is not ready to issue certificates on time, the Regulation provides for a phasing-in period of six weeks, when other formats can still be used and should be accepted in other Member States.

Which information will the EU Digital COVID Certificate include?

The EU Digital COVID Certificate will only contain necessary information such as name, date of birth, the certificate issuer and a unique identifier of the certificate. In addition:

• For a vaccination certificate: vaccine type and manufacturer, number of doses received, date of vaccination;
• For a test certificate: type of test, date and time of test, place and result;
• For a recovery certificate: date of positive test result, validity period.

What will be the practical steps for a citizen to get an EU Digital COVID Certificate?

After getting a vaccine in an EU country, you will receive the EU Digital COVID Certificate either automatically or upon request. The Certificate will be issued by the authorities of EU Member States, which could also be the body that administers the vaccine. It could be a hospital or another health authority, or via an e-health portal. The same principle will work for the test and recovery certificates. The details for the issuance of the certificates are laid down by the respective Member States.

EU citizens who were vaccinated in a non-EU country can request the EU Digital COVID Certificate from the Member State of their nationality or residence. The EU Digital COVID Certificate will be issued, if there is a reliable proof of vaccination and if the structure of the health system allows for it. For further information, please address your Member State of nationality or residence.

Which vaccines will be accepted?

Member States should issue vaccination certificates regardless of the type of COVID-19 vaccine.

Where Member States accept proof of vaccination to waive certain public health restrictions such as testing or quarantine, they will be required to accept, under the same conditions, vaccination certificates issued under the EU Digital COVID Certificate system. However, this obligation is limited to vaccines that received EU-wide marketing authorisation. Member States have the option to also accept vaccination certificates issued in relation to vaccines that have been authorised at national level or by the World Health Organization (WHO).

Can the Digital COVID Certificate be issued already after the first vaccination dose?

Certificates will be issued to any person who received a COVID-19 vaccination in an EU Member State, irrespective of the number of doses. The number of doses will be clearly stated in the EU Digital COVID Certificate to indicate whether the vaccination course has been completed.

Furthermore, the Regulation requires Member States to accept vaccination certificates under the same conditions, meaning that, for example, where a Member State decides to lift travel restrictions for its own citizens that have a certificate for the first dose of a two-dose vaccine which has received EU-wide marketing authorisation, it has to extend the same treatment to other EU citizens.

On 31 May, the Commission has proposed that Member States lift travel restrictions to persons who are fully vaccinated (at the latest 14 days after the last dose) or recovered from COVID-19 and who are holders of the EU Digital COVID Certificate.

I have recovered from COVID-19 and my Member State has decided to only offer one dose of a two-dose vaccine to me. Will I be able to benefit from the Digital COVID Certificate?

It is for Member States to decide whether to administer only one dose of a two-dose vaccine to recovered persons. Where they do so, the vaccination certificate should indicate that the vaccination course has been completed following the administration of one dose.

The Commission has proposed that people who have received a single dose of a two-dose vaccine after having previously been infected with COVID-19 should be considered fully vaccinated for the purpose of travel.

What will happen for those people who have already been vaccinated?

People who were vaccinated before the EU Digital COVID Certificate is put in place have the right to receive a vaccination certificate in the new format. If they have received a vaccination certificate that did not meet the interoperable standards established by the Regulation, they can request a new one from the national authorities.

What will the EU Digital COVID Certificate look like?

The EU Digital COVID Certificate will be available in digital format, for instance in a smartphone app, or on paper, as each person prefers. The certificates will contain a QR code with the necessary data as well as a digital signature. The QR code is used to securely verify the authenticity, integrity and validity of the certificate. The information on the certificate will be written in the language(s) of the issuing Member State and in English. A common design template was developed with Member States to facilitate the recognition of EU COVID Certificates issued in paper format.

How does the EU Digital COVID Certificate work across the EU?

The EU Digital COVID Certificate contains a QR code with a digital signature to protect it against falsification. When the certificate is checked, the QR code is scanned and the signature verified.

Each issuing body (e.g. a hospital, a test centre, a health authority) has its own digital signature key. All of these are stored in a secure database in each country.

On 1 June, the Commission activated a gateway through which all certificate signatures can be verified across the EU. The personal data of the certificate holder does not pass through the gateway, as this is not necessary to verify the digital signature.

Prior to going live, the gateway was successfully tested by more than 20 Member States and Iceland.

The Commission also provides open source reference implementations to support Member States to develop software that authorities can use to scan and check the QR codes.

Will the EU Digital COVID Certificate be accepted in Switzerland and EEA countries?

The Regulation will be incorporated into the European Economic Area (EEA) Agreement, allowing EEA countries (Iceland, Liechtenstein and Norway) to apply the system of EU Digital COVID Certificates.

The Swiss certificates should be accepted under the same conditions as the EU Digital COVID Certificate, once reciprocity is confirmed by Switzerland and after the Commission has adopted a decision that Swiss certificates are equivalent to the EU Digital COVID Certificate. Contacts with Switzerland on this issue are ongoing.

Can children get an EU Digital COVID Certificate?

Yes, children can get an EU Digital COVID Certificate.

The European Medicines Agency (EMA) gave its green light to the use of the BioNTech Pfizer vaccine for children of 12-15 year. Children can also receive a test or recovery certificate. These certificates could also be received by their parents and stored in the parents’ smartphone app.

On 31 May, the Commission proposed that minors travelling with parents should be exempted from quarantine when the parents do not need to undergo quarantine, for example due to vaccination. Children under 6 should also be exempted from travel-related testing.

Which COVID-19 tests will be accepted?

To ensure the reliability of the test result, only the so-called NAAT tests (including RT-PCR tests) and the rapid antigen tests featured in the common list established on the basis of Council Recommendation 2021/C 24/01 should be eligible for a test certificate issued on the basis of the EU Digital COVID Certificate Regulation.

However, it is left to each Member State to decide whether it accepts rapid antigen tests, or only NAAT tests (such as RT-PCR tests).

On 21 January 2021, the Council adopted a recommendation setting a common framework for the use of rapid antigen tests and the mutual recognition of COVID-19 test results across the EU. On 11 May 2021, the EU Health Security Committee agreed to update the common list of COVID-19 rapid antigen tests (RATs). 83 rapid antigen tests are now included in the common list. The Health Security Committee also agreed to simplify the procedure for updating the list, making it easier for manufacturers to submit data on rapid antigen tests available on the market here.

How is the Commission supporting Member States in making COVID-19 tests more affordable?

In order to support Member States’ testing capacities, the Commission has mobilised €100 million under the Emergency Support Instrument to purchase and distribute over 20 million rapid antigen tests, and has launched a joint procurement for over half a billion rapid antigen tests. Moreover, to further support the availability of affordable tests, the Commission committed to mobilise additional €100 million under the Emergency Support Instrument to purchase COVID-19 tests that qualify for the issuance of an EU Digital COVID Certificate.

Will Member States have to accept anyone travelling with PCR/Rapid antigen test?

In line with the Regulation, if a Member State accepts a test certificate for waiving travel restrictions, it should also accept holders of an EU Digital COVID test certificate under the same conditions. If a Member State lifts restrictions only for holders of PCR tests, it is not required to accept rapid antigen tests. However, if it accepts rapid antigen tests then it must also accept rapid antigen test certificates issued by another Member State.

Why will self-tests not be included?

Self-tests are not performed in controlled conditions and, for the time being, are considered to be less reliable. Certificates should be issued by health authorities, which cannot control tests that are performed, for example, at home, and cannot therefore issue reliable certificates for them.

Will there be a minimum validity of the certificates?

On 31 May, the Commission proposed to update the Council recommendation on the coordination of the travel measures, which includes standard validity periods for tests: 72 hours for PCR tests and, where accepted by a Member State, 48 hours for rapid antigen tests.

The Regulation also introduces some basic principles, for example, setting the maximum validity period of the certificate of recovery at 180 days. These principles could be adjusted by the Commission on the basis of new scientific evidence. The Regulation in any case ensures that certificates issued by other Member States are accepted following the same rules as the ones applied to nationally issued certificates.

There is no maximum validity foreseen for vaccination certificates, as this will depend on emerging scientific evidence as to the length of protection of the different vaccines.

For how long will the EU Digital COVID Certificate be in place?

The Regulation will apply for 12 months as from 1 July 2021.

The Commission will present a report to the European Parliament and the Council on the application of the Regulation three months before the end of application of the Regulation. Together with this report, the Commission could propose to extend the date of application of the Regulation, taking into account the evolution of the epidemiological situation on the pandemic.

What will be the cost of the EU Digital COVID Certificates?

The EU Digital COVID Certificates will be free of charge, as it should be easily available to everyone.

3. Personal data

How will personal data be processed?

Given that the personal data contained in the certificates includes sensitive medical data, a very high level of data protection is ensured.

The certificates will only include the minimum amount of information that is necessary. This cannot be retained by visited countries. For verification purposes, only the validity and authenticity of the certificate is checked, by verifying who issued and signed it. During this process, no personal data is exchanged. All health data remains with the Member State that issued an EU Digital COVID Certificate.

The EU Digital COVID Certificate system will not require the setting up and maintenance of a database of health certificates at EU level, and no personal data will be exchanged via the EU gateway.

4. Interoperability – inside and outside the EU

How is interoperability of the EU Digital COVID Certificates ensured?

Interoperability is achieved by making sure that the different types of EU Digital COVID Certificates (vaccination status; test results; recovery status) are standardised according to commonly agreed policies, rules and specifications. This means in practice that any certificate issued in one Member State can be verified in another Member State. Member States will retain flexibility in how they link the issuing and verification of their certificates to their national systems so long as they meet these common standards.

Member States, supported by the Commission, have agreed on all technical specifications for the EU Digital COVID Certificates, their interoperability and full compliance with personal data protection. The specifications are openly available.

In practical terms, the Commission has set up a gateway through which digital signature keys can be exchanged between Member States, so that the EU Digital COVID Certificates can be verified across the EU.

What is the EU gateway exactly?

The EU gateway is a digital infrastructure connecting national databases that contain public signature keys. This will allow digital signatures included in the QR codes of the certificates to be verified across the EU. The personal data of the certificate holder does not pass through the gateway, as this is not necessary to verify the digital signature. The EU gateway was set-up by T-Systems and SAP and is hosted at the Commission’s data centre in Luxembourg.

Is the system already operational?

Yes. The gateway went live on 1 June. Prior to this, it was successfully tested by more than 20 Member States and Iceland. While the Regulation will be applied from 1 July, all Member States that have tested the gateway successfully and are ready to issue and verify certificates can start using the system on a voluntary basis, provided they have the necessary legal base in place.

How did the Commission support Member States?

Since November 2020, the Commission supported the work of Member States on certificates in the eHealth Network, a voluntary network connecting national authorities responsible for eHealth. First guidelines were already published in January 2021.

The Commission also set up the gateway, the technical infrastructure necessary to verify electronic signatures cross border.

Furthermore, the Commission has provided Member States with open source software and apps to easily develop their national solutions for the issuance and verification of EU Digital COVID Certificates and for citizens to store them on their smartphones (reference wallet app).

Finally, the Commission also provided technical and financial support to Member States to on-board the gateway (€1 million per Member State).

Why does the EU not use a commercial supplier of IT infrastructure?

The Commission has already a strong experience in running EU-wide IT systems and is trusted by all Member States as a neutral and reliable operator. The Commission’s main corporate data centre, as well as the Commission services managing the data centre, have been located in Luxemburg for many years. This is where the Commission can ensure the highest security, stability and reliability of its IT infrastructure supporting the EU Gateway.

Will the EU Digital COVID Certificate be compatible with other systems developed at international level?

The Commission is working to make sure that the certificates are compatible with systems in countries outside the EU. The proposal is open to global initiatives and takes into account ongoing efforts of the WHO and the International Civil Aviation Organization (ICAO) to establish specifications and guidance for using digital technologies for documenting vaccination status. Non-EU countries should be encouraged to recognise the EU Digital COVID Certificate when lifting restrictions on non-essential travel. The Certificates could serve as an example for other certificates currently being developed around the world.

The Regulation allows the Commission to issue decisions recognising certificates issued by non-EU countries to EU citizens and their family members, where such certificates meet quality standards and are interoperable with the EU trust framework.

5. Non-EU nationals traveling to the EU

Can the EU Digital COVID Certificate facilitate travelling to the EU from non-EU countries?

On 20 May, the Council adopted a revised Recommendation updating the approach to travel from outside the EU. The Council Recommendation aims to ease the current restrictions on non-essential travel into the EU taking into account the progress of vaccination campaigns and developments in the epidemiological situation worldwide.

Where the Commission is satisfied that a non-EU country issues certificates in compliance with standards and systems, which are interoperable with the EU system, the Commission can adopt a decision on the basis of which such non-EU country certificates would be accepted according to the same conditions as EU Digital COVID Certificates.

In any case, the rules for acceptance of proof of vaccination would be the same as for EU nationals: vaccines that have received EU-wide marketing authorisation have to be accepted, but Member States can decide to also accept vaccines approved by the WHO.

⯈ SOURCE ⯇