On the 12^th of May 2021, the CNIL has expressed it opinion on the health card project introduction for the access in specific public places where large gatherings of people are reunited. The CNIL asks that the legislation is clarified and that are provided additional guarantees.

Main point

• The CNIL has given its opinion, under an extremely urgence, on the project of the government to introduce a heath card in order to regulate the access to specific places, establishments or events, in a context of health restrictions removal.
• First of all, the CNIL remembers the need to guarantee the temperance character of the system.
• It considers the idea that the usage of this pass is limited to events that affect large gatherings of people, by excluding in particular everyday activities (places of work, restaurants, shops, etc.) permits to limit the personal data protection breaches and the respect of the people’s privacy.
• Anyway, due to the stakes for rights and fundamental freedoms of people, the CNIL considers that the legislation shall define in a specific way purposes, the nature of places, establishments and interested manifestations as well as the minimum threshold of expected participation. It shall also prohibit the possibility for professionals that are not covered by the system to subordinate the access to their establishment to the presentation of the health card.
• At the end the CNIL underlines that the system shall include a specific number of guarantees in order to limit as possible the sharing and the storage of private information in order to avoid any risk of discrimination, based on the health status but also on the ability to access and used digital instruments (having a smartphone, voluntary usage of the app “TousAntiCovid”, etc).
• The CNIL ends that the usage of a health card can be taken in consideration only under reservation and detailed conditions in its opinion.

The context

In order to permit the recovery of some activities which have been interrupted due to the health crisis and the reopening of closed places by minimizing, as possible, contamination risks connected, the government is considering to subordinate the access to specific places, establishments or events that affect large gatherings of people (more than 1.000) to the presentation of a new proof that a person has been vaccinated against COVID-19, has received a negative result of the test or has been recovered from the COVID-19 infection.

Practically, is the functionality of the app. TousAntiCovid, which has been initially developed in order to permit trips which requires a health control in the context of the future European “digital green certificate”, which could be used for the access to places, events and interested establishments.

Due to the stakes for individuals and the unprecedent character of he system, the CNIL has regretted in its opinion of having to give an opinion in a so shot period of time and after debates that took lace during its first National Assembly, even if the principle of the health card has been discussed since a lot of time.

On the temporary nature of health passes

Even if it is not its role to comment the scientific usefulness of a system, on which the Scientific Council has expressed a positive opinion, the CNIL underlines that it usage should not in any cases being kept in addition to the health crisis. Actually, the maintenance of the system shall be limited to the time which is strictly necessary to reply to the health situation and shall, in each case, stop as soon as it disappears.

The CNIL asks that the impact on the system of the health situation is frequently studied and documented, on periodically and based on objective data, in order to help public authorities in deciding is keeping it or not, and asks that those elements are shared.

On guarantees that shall be implemented upon the respect of rights and fundamental freedoms of interested people

The limited usage to event to which participate large gatherings of people

The government has indicated that it will limit the usage of the health pass only to higher risks events due to the large gatherings of people, and will exclude places connected to everyday life of population (restaurants, working places, shops, etc.) and those one related to usual manifestations of fundamental freedoms (in particular the freedom of manifestant, political or industrial reunion and the freedom of religion). The CNIL considers that those limitation provide guarantees which minimize the consequences of the system on rights and freedoms of persons.

Anyway, regrets the lack of a specific definition of the nature of places, establishments and manifestation and considers that it is necessary to establish the legislation:

• The stake of simultaneous presences, and methods of assessing of this stake, above which it should be implemented the health card;
• The restrictions on the abuse of the health card, by prohibiting explicitly the possibility for owners of places not covered by the system to subordinate the access, by their own initiative to the presentation on digital certificated proofs.

Guarantee a high level of personal data protection

The CNIL considers that, due to its sensitive and new character, the legislation and the Regulation shall specific concrete terms of this system (purposes, nature of interested places, authorized persons to verify the proofs, etc.) as well as guarantees which are necessary to avoid any breach of the right to the private life and personal data protection (any storage of data during the verification, any possibility of data reusage for other purposes, etc.).

In addition, the CNIL has underlined the importance to share private information, relative to the health of people, during the verification of certificates. It invites the government to implement, as soon as possible, a solutions that permit to limit the access to authorized person to verify certificates to a result (green or red color), in addition to the identity of the owner, in order to not revealing if he/she has been vaccinated, or if he/she has been submitted to a test or if he/she has been recovery from COVID-19.

Control the risks of discrimination and ensure that all are included into the system

In its opinion, the CNIL underlines the importance to guarantee the inclusion of all the population into the system, in order to avoid any risks of discrimination, not only on a basis of the health status, but also on the ability to access and use digital instruments like the app TousAntiCovid.

For this reason, it underlines the need to prohibit any discrimination among different types of proof and precises that a system, that shall be part of a global an coherent health strategy, can be justified like a complement to an active political of access to tests and vaccines.

At the end, the CNIL remembers that those certificates shall be available also in a “paper” format in order to guarantee that the all population is included in the system. It invites the government to consider the format and the content of certified paper proof in order that they can offer the same guarantees of their final version in terms of accessibility or personal data protection.

The CNIL will control practical moods of implementation of this system and will guarantee the respect of rights and freedom of persons, in particular by taking advantages of controls powers that entrusted to them by the legislator.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA FRANCIA – CNIL