Privacy preserving COVID-19 vaccinating- and testing-pass for the European Union

Abstract

Abstract Purpose Physicians and scientists hope to gain new insights from health data to improve medical care and optimize costs in the healthcare sector. However, data protection laws in Europe often impose limits on the use of patient data. During the COVID-19 pandemic the exercise of all civil rights and liberties depends on successful vaccinations, negative tests, and recovery from the disease. Digital proof thereof was of particular importance for participation in social life. This research project aims to create a system concept for vaccination, testing, and recovery proof called P3VT (Privacy Preserving Pass for Vaccination and Testing), which makes all collected data anonymously available in real time to scientists as well as to political pandemic management. Methods Based on the Design Science Research methodology (DSR) [1], P3VT is the artifact created by the research project. It was developed over several iterations, consistently taking into consideration the goals of privacy-by-design, data minimisation and transparency of the EU-GDPR. Expert interviews have been conducted to validate the system from a medical, technical and data protection perspective. Results By using distributed ledger technology and distributed identities, P3VT offers the following advantages compared to the EU digital COVID certificate: · Pseudonymous proof of vaccination, testing, and recovery, reducing the misuse of sensitive personal data · Transparency on type, time, and purpose of proof increases users' trust · Use of anonymous vaccination and testing data to improve regulatory pandemic management, as well as research · Flexible specification of proof conditions based on the latest epidemiological findings or individual requirements · Elimination of manual ID checks during the verification process. Conclusion P3VT provides a novel combination of unforgeable pseudonymous proof of COVID-19 vaccination, testing, and recovery with simultaneous provision of anonymous data for research purposes and regulatory pandemic management. It is therefore an example of how the comprehensive provision of health data for research purposes can be combined with high data protection requirements. Further areas of application are conceivable.