(1)

Regulation (EU) 2021/953 sets out the EU Digital COVID Certificate which provides proof that a person has received a COVID-19 vaccine, a negative test result or has recovered from infection for the purpose of facilitating the holders’ exercise of their right to free movement during the COVID-19 pandemic.

(2)

Regulation (EU) 2021/954 of the European Parliament and of the Council (2) provides that Member States are to apply the rules laid down in Regulation (EU) 2021/953 to third-country nationals who do not fall within the scope of that Regulation, but who are legally staying or residing in their territory and who are entitled to travel to other Member States in accordance with Union law.

(3)

Council Recommendation (EU) 2022/290 amending Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction (3) provides that third-country nationals wishing to undertake non-essential travel from a third countries to the Union should be in the possession valid proof of vaccination or recovery, such as a EU Digital COVID Certificate or a COVID-19 certificate issued by a third country covered by an implementing act adopted pursuant to Article 8(2) of Regulation (EU) 2021/953.

(4)

In order for the EU Digital COVID Certificate to be operational throughout the Union, the Commission adopted Implementing Decision (EU) 2021/1073 (4), laying down technical specifications and rules to populate, securely issue and verify EU Digital COVID Certificates, ensure the protection of personal data, lay down the common structure of the unique certificate identifier and issue a valid, secure and interoperable barcode.

(5)

In accordance with Article 4 of Regulation (EU) 2021/953, the Commission and the Member States were to set up and maintain a trust framework for the EU Digital COVID Certificate. That trust framework is able to support the bilateral exchange of certificate revocation lists containing the unique certificate identifiers of revoked certificates.

(6)

On 1 July 2021, the EU Digital COVID Certificate gateway (the ‘gateway’), which is the central part of the trust framework and which allows for the secure and trusted exchange between Member States of public keys used to verify EU Digital COVID Certificates, became operational.

(7)

Due to their successful and large-scale rollout, EU Digital COVID Certificates have become a target for fraudsters seeking to find ways to issue fraudulent certificates. Those fraudulent certificates need therefore to be revoked. In addition, certain EU Digital COVID Certificates may be revoked by Member States at national level for medical and public health reasons, for example because a batch of vaccines administered was later found to be defective.

(8)

While the EU Digital COVID Certificate system is capable of immediately revealing forged certificates, authentic certificates that are unlawfully issued on the basis of false documentation, unauthorised access or with fraudulent intent cannot be detected in other Member States unless the lists of revoked certificates generated at national level are exchanged between Member States. The same applies for certificates that have been revoked for medical and public health reasons. Failure by Member States’ verification applications to detect certificates revoked by other Member States poses a threat to public health and undermines citizens’ trust and confidence in the EU Digital COVID Certificate system.

(9)

As noted in Recital 19 of Regulation (EU) 2021/953, Member States should, for medical and public health reasons and in the event of fraudulently issued or obtained certificates, be able to establish and exchange with other Member States for the purpose of that Regulation certificate revocation lists in limited cases, in particular as regards certificates that have been issued erroneously, as a result of fraud or following the suspension of a COVID-19 vaccine batch found to be defective. Member States should not be able to revoke certificates issued by other Member States. Certificate revocation lists exchanged should not contain any personal data other than unique certificate identifiers. In particular, they should not include the reason why a certificate has been revoked.

(10)

In addition to the general information about the possibility of revocation of certificates and the possible reasons for that, holders of revoked certificates should be promptly informed by the responsible issuing authority about the revocation of their certificates and the reasons for the revocation. However, it may in some cases, and in particular in the case of EU Digital COVID Certificates issued on paper, prove impossible or could involve a disproportionate effort to trace and inform the holder of the revocation. Member States should not collect additional personal data not needed for the issuance process only to be able to inform certificate holders in case their certificates are revoked.

(11)

It is thus necessary to enhance the EU Digital COVID Certificate trust framework by supporting the bilateral exchange of certificate revocation lists between Member States.

(12)

This Decision does not cover temporary suspension of certificates for national use cases outside the scope of the EU Digital COVID Certificate Regulation, for example because the holder of a vaccination certificate has tested positive for SARS-CoV-2. It is without prejudice to established procedures for checking the business rules for the validity of certificates.

(13)

While, from a technical point of view, different architectures for the exchange of revocation lists are feasible, exchanging them via the gateway is the most appropriate one as it limits data exchanges to the trust framework already established and as it minimises the number of both possible points of failure and exchanges between Member States compared to an alternative peer-to-peer system.

(14)

Accordingly, the EU Digital COVID Certificate gateway should be enhanced to support the secure exchange of revoked EU Digital COVID Certificates for the purpose of their secure verification via the Gateway. In this regard, appropriate security measures to protect the personal data processed in the gateway should be implemented. To ensure a high level of protection, Member States should pseudonymise certificate attributes by means of an irreversible hash to be included in the revocation lists. Indeed, the unique identifier should be considered as pseudonymised data for the processing operations carried out within the framework of the gateway.

(15)

In addition provisions on the role of the Member States and of the Commission as regards the exchange of certificate revocation lists should be laid down.

(16)

The processing of personal data of certificate holders, which is done under the responsibility of the Member States or other public organisations or official bodies in the Member States, should be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (5). Processing of personal data under the responsibility of the Commission for the purpose of managing and ensuring the security of the EU Digital COVID Certificate Gateway should comply with Regulation (EU) 2018/1725 of the European Parliament and of the Council (6).

(17)

The Member States, represented by the designated national authorities or official bodies, determine together the purpose and means of processing of personal data through the EU Digital COVID Certificate gateway and are therefore joint controllers. Article 26 of Regulation (EU) 2016/679 places an obligation on joint controllers of personal data processing operations to determine, in a transparent manner, their respective responsibilities for compliance with the obligations under that Regulation. It also provides for the possibility to have those responsibilities determined by Union or Member State law to which the controllers are subject. The arrangement referred to in Article 26 should be included in Annex III to this Decision.

(18)

Regulation (EU) 2021/953 assigns a task to the Commission to support such exchanges. The most appropriate way to fulfil that mandate is to collate the submitted certificate revocation lists on behalf of the Member States. Therefore a data processor role should be assigned to the Commission to support these exchanges by facilitating the exchange of lists via the EU Digital COVID Certificate gateway on behalf of the Member States.

(19)

The Commission, as a provider of technical and organisational solutions for the EU Digital COVID Certificate gateway, processes the personal data in the revocation lists in the gateway on behalf of the Member States as joint controllers. Therefore, it acts as their processor. Pursuant to Article 28 of Regulation (EU) 2016/679 and Article 29 of Regulation (EU) 2018/1725, the processing by a processor is to be governed by a contract or a legal act under Union or Member State law which is binding on the processor with regard to the controller and which specifies the processing. Therefore it is necessary to lay down rules on processing by the Commission as a data processor.

(20)

The Commission’s supporting task does not involve the establishment of a central database as referred to in Recital 52 of Regulation (EU) 2021/953. That prohibition is intended to avoid a central repository of all EU Digital COVID Certificates issued and does not preclude the Member States from exchanging revocation lists, which is expressly provided for in Article 4(2) of Regulation (EU) 2021/953.

(21)

When processing personal data in the EU Digital COVID Certificate gateway, the Commission is bound by Commission Decision (EU, Euratom) 2017/46 (7).

(22)

Article 3(10) of Regulation (EU) 2021/953 allows the Commission to adopt implementing acts establishing that COVID-19 certificates issued by a third country with which the Union and the Member States have concluded an agreement on the free movement of persons allowing the contracting parties to restrict such free movement on grounds of public health in a non-discriminatory manner and which does not contain a mechanism of incorporation of Union legal acts are equivalent to those issued in accordance with this Regulation. On that basis, the Commission adopted, on 8 July 2021, Implementing Decision (EU) 2021/1126 (8) establishing the equivalence of COVID-19 certificates issued by Switzerland.

(23)

Article 8(2) of Regulation (EU) 2021/953 allows the Commission to adopt implementing acts establishing that COVID-19 certificates issued by a third country in accordance with standards and technological systems that are interoperable with the trust framework for the EU Digital COVID Certificate and that allow for the verification of the authenticity, validity and integrity of the certificate, and which contain the data set out in the Annex to the Regulation, are to be considered as equivalent to EU Digital COVID Certificates for the purpose of facilitating the holders’ exercise of their right to free movement within the Union. As noted in Recital 28 of Regulation (EU) 2021/953, Article 8(2) of that Regulation concerns the acceptance of certificates issued by third countries to Union citizens and their family members. The Commission has already adopted several such implementing acts.

(24)

To avoid gaps in the detection of revoked certificates covered by such implementing acts, it should also be possible for third countries whose COVID-19 certificates have been deemed equivalent pursuant to Article 3(10) and Article 8(2) of Regulation (EU) 2021/953 to submit relevant certificate revocation lists to the EU Digital COVID Certificate gateway.

(25)

Some third-country nationals who hold revoked COVID-19 certificates issued by a third country whose COVID-19 certificates have been deemed equivalent pursuant to Regulation (EU) 2021/953 may fall outside the scope of either that Regulation or Regulation (EU) 2021/954 at the moment a revocation list including their certificates is generated by the third country concerned. However, whether all third country nationals holders of revoked certificates fall within the scope of either Regulation cannot be known at the time when a certificate revocation list is generated by a third country concerned. Seeking to exclude persons not covered by the scope of either regulation at the moment when those countries’ certificate revocation lists are generated is thus not feasible, and attempting to do so would result in Member States being unable to detect revoked certificates held by third-country nationals travelling to the Union for the first time. However, even the revoked certificates of those third country nationals would be verified by Member States when their holders travel to the Union, and subsequently, when they travel within the Union. The third countries whose certificates have been deemed equivalent pursuant to Regulation (EU) 2021/953 are not involved in the governance of the gateway and thus do not qualify as joint controllers.

(26)

In addition, the EU Digital COVID Certificate system has proven to be the only COVID-19 certificate system operational at international level on a large scale. As a result, the EU Digital COVID Certificate has gained increasing global significance and has contributed to addressing the pandemic at the international level by facilitating safe international travel and global recovery. In the process of adopting additional implementing acts pursuant to Article 8(2) of Regulation (EU) 2021/953, new needs regarding populating the EU Digital COVID Certificate arise. According to the rules set out in Implementing Decision (EU) 2021/1073, the surname is a mandatory field in the technical contents of the certificate. It is necessary to amend that requirement to promote inclusion and interoperability with other systems, given that, in some third countries, there are persons without a surname. In cases where the certificate holder’s name cannot be divided into two parts, the name should be placed in the same field (surname or forename) of the EU Digital COVID Certificate as would be done the holder’s travel or identity document. This change would also better align the technical contents of the certificates with the currently valid specifications on machine-readable travel documents published by the International Civil Aviation Organization.

(27)

Implementing Decision (EU) 2021/1073 should therefore be amended accordingly.

(28)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 11 March 2022.

(29)

To allow Member States and the Commission sufficient time to implement the changes needed to enable the exchange of certificate revocation lists via the EU Digital COVID Certificate gateway, this Decision should start to apply four weeks after its entry into force.

(30)

The measures provided for in this Decision are in accordance with the opinion of the Committee set up under Article 14 of Regulation (EU) 2021/953,

(1)

the following Articles 5a, 5b and 5c are inserted:

(2)

Annex I is amended in accordance with Annex I to this Decision;

(3)

Annex V is amended in accordance with Annex II to this Decision;

(4)

the text in Annex III to this Decision is added as Annex VI;

(5)

the text in Annex IV to this Decision is added as Annex VII.