In 2021, the European Commission and EU Member States built the EU Digital COVID Certificate (EU DCC) trust framework, which allowed the issuance and verification of common and interoperable COVID certificates as proofs of vaccination, test, or recovery.
A total of 78 countries and territories are connected to the EU DCC system, which contributed to safeguarding free movement within the EU during the COVID pandemic. In June 2023, the World Health Organization (WHO) incorporated the EU DCC technology into the Global Digital Health Certification Network.
The Commission and EU Member States also used mobile contact tracing and warning applications to fight the COVID pandemic. These tools helped to minimise the spread of the virus nationally and across borders and speed up a return to normal life within the EU.
EU Digital COVID Certificate
The EU Digital COVID Certificate (EU DCC) was digital proof that people have been vaccinated, recovered, or have a test result regarding COVID-19. Therefore, the EU Digital COVID Certificate includes 3 types of certificates: vaccination, recovery, and test.
The eHealth Network collaborated with EU agencies, the Health Security Committee, the World Health Organization (WHO) and other institutions in a coordinated response to COVID-19, including implementing COVID certificates.
The success of the EU Digital COVID Certificate was acknowledged in 2023 by the European Ombudsman, who awarded DGs JUST, CNECT, and SANTE with the European Ombudsman Award for Good Administration in the Innovation category.
The EU Digital COVID Certificate after the expiry of the Regulation (EU) 2021/953
The EU Digital COVID Certificate Regulation entered into application on 1 July 2021 and expired on 30 June 2023.
The European Commission and the WHO signed a non-binding Administrative Arrangement agreeing to collaborate on the uptake of the EU Digital COVID Certificate framework by the WHO and the further development of the Global Digital Health Certification Network.
This global system will help facilitate global mobility and protect people worldwide from on-going and future health threats, including pandemics.
Based on this agreement, the WHO took up the EU Digital COVID Certificate framework and launched the Global Digital Health Certification Network (GDHCN) in June 2023. Currently, the GDHCN only supports the verification of EU DCC-like certificates.
However, it could be expanded to other uses such as the digitisation of the International Certificate of Vaccination or Prophylaxis, verification of prescriptions across borders, the International Patient Summary, verification of vaccination certificates within and across borders, and certification of public health professionals (through WHO Academy).
The Council Recommendation adopted on 27 June 2023 encourages all Member States to join the WHO system and to continue issuing COVID-19 certificates upon request.
Transitional period
The Council Recommendation adopted in June 2023 welcomes the Commission’s intention to maintain the EU Gateway for a transitional period until the end of December 2023. This will allow enough time for EU Member States, third countries and territories connected to the EU DCC Gateway to make the necessary changes and steps to connect to the Global Digital Health Certification Network.
During the transitional period, the two systems will be synchronised so that the certificates can be verified independently of to which gateway the issuing and verifying country is connected, provided that the certificates have been issued based on standards and technological systems.These systems have to be interoperable with the trust framework of the EU Gateway allowing, the verification of their authenticity, validity and integrity.
Legal texts
Trust framework and detailed technical specifications
The eHealth Network has published detailed technical specifications describing mechanisms for the interoperability of vaccination, test and recovery certificates. The specifications are available below.
Reference implementations have been published and are available as open source.
Technical specifications were adopted as Commission Implementing Decisions. A consolidated version is provided below for ease of reference. The WHO Global Digital Health Certification Network also takes up these technical specifications.
The following technical specifications published as eHN Guidelines provide further explanations and instructions complementing the adopted Commission Implementing Decisions.
- Value sets, such as specifications for vaccine coding or additional country codes, complementing those included in the Commission Implementing Decisions. See also their open source implementation.
- Volume 1: formats and trust management
- Volume 2: EU Digital COVID Certificate Gateway
- Volume 3: 2D Barcode Specifications
- Volume 4: EU Digital COVID Certificate Applications
- Volume 5: Public Key Certificate Governance
- EU DCC Validation Rules
- Validation of EU Digital COVID Certificates in the context of air transport
- A common standardised set of data to be included in COVID-19 test result certificates (adopted by the Health Security Committee)
- Guidelines on the use of Digital Covid Certificates in traveller and online booking scenarios
- DCC anomaly capture process, best current practice
- Template: paper version of the EU Digital COVID Certificate
- EU DCC Revocation - B2A Communication between the Backend and the Applications
Open source reference implementations
EU DCC Trust List page allows the download of the EU Digital Covid Certificates (EU DCC) Signer Certificates Archive.
Mobile contact tracing and warning applications
Mobile contact tracing and warning applications helped reduce the spread of COVID-19 by informing people if they had been near people who subsequently tested positive for the virus and encouraging them to inform health authorities and ask for support.
Users could install contact tracing applications voluntarily, which relied on Bluetooth proximity-tracing technology to protect privacy.
The eHealth Network issued a common EU Toolbox for Member States on contract tracing applications and produced comprehensive interoperability guidelines and specifications.
Based on this, the European Commission deployed an EU-wide gateway in September 2020 to enable cross-border interoperability between applications and 19 countries connected to it gradually. This allowed users to travel with one single application connected to the interoperability gateway and be warned if exposed to COVID-19 through prolonged proximity to or close contact with infected people.
National authorities discontinued these contact tracing applications when not further needed, and the EU-wide gateway was stopped in February 2023.
Joint controllership and data protection
The cross-border exchange of data between national contact tracing and warning mobile applications was defined in the corresponding Commission Implementing Decision. The countries participating in the gateway, represented by the designated national authorities or official bodies, acted as joint controllers for the processing in the gateway.
The European Commission prepared a document providing information on the European Federation Gateway Service that the Member States, as controllers, could use as input to their respective own Data Protection Impact Assessment for the exchange of personal data via the gateway.
More information
- Press release: Coronavirus - EU interoperability gateway goes live, first contact tracing and warning apps linked to the system
- Press Release: EC starts testing interoperability gateway service for national contact tracing and warning apps
- Questions and Answers: a common approach for safe and efficient mobile tracing apps across the EU
- Digital Contact Tracing Study
- Guidance on data protection
