ACLU: There's a Lot That Can Go Wrong With 'Vaccine Passports'

With COVID-19 vaccination rates accelerating, governments around the world have begun to consider implementing a standardized credential or "vaccine passport" that would let people prove that they've been vaccinated. And the idea became more real when the Washington Post reported on Sunday that the Biden administration was working with companies to develop such a structure.

As privacy advocates and civil libertarians, there are several factors to consider on vaccine passports.

There is a difference between a standardized system for presenting proof of vaccination, and a digital system for doing so. With more and more of our credentials being displayed through apps on our phones — from airline boarding passes to concert tickets to gym memberships — it strikes many people as an obvious and overdue step to create a similar digital credential for those occasions when a person has to prove that they've been vaccinated. But digital credentials present a number of new potential problems, and we would oppose a vaccination credential system that does not meet three crucial criteria:

1. It is not exclusively digital. A system that is exclusively digital, whether by design or as a practical matter, would be a nonstarter because it would increase inequality. Many people don't have smartphones, including disproportionate numbers from some of our most vulnerable communities, such as people who are low-income, have disabilities, or are homeless, as well as more than 40 percent of people over age 65.

2. It is decentralized and open source. ... But given the difficulty of creating a digital vaccine passport, we could see a rush to impose a COVID credential system built on an architecture that is not good for transparency, privacy, or user control. That could lock us into a bad standard as other parties that need to issue credentials piggyback upon it to offer everything from age verification to health records to hunting licenses to shopping accounts, memberships, and web site logins.

3. It does not allow for tracking or the creation of new databases. Unless a vaccine credential system is completely decentralized and user-centric, it creates the potential for amassing new personal data. If some big company is getting notified any time someone reads one of your credentials, that would let them track your movements and interests — the stores, concerts, and transportation venues you visit, and much more.

We also worry that a vaccine passport will encourage over-use. The issues around passport design are separate from the question of where and when people can be required to furnish proof of vaccinations, but if a passport system makes it very easy to ask for and to provide proof of vaccination, it's likely that such requests will become over-used as people get asked for credentials at every turn.

We don't oppose in principle the idea of a requiring proof of vaccination in certain contexts. But given the enormous difficulty of creating a digital passport system, and the compromises and failures that are likely to happen along the way, we are wary about the side effects and long-term consequences it could have. We will be closely watching developments in this area.

Newer News
Thousands of Freed Border-Crossing Immigrants Are Dispersing Across America

Older News
Delta CEO blasts Georgia voting law as 'unacceptable' and 'based on a lie'

Privacy

ACLU: There's a Lot That Can Go Wrong With 'Vaccine Passports'

Think long and hard, ACLU, if you really want to offer talking points to fascists