Skip to main content
European Commission logo
Public Health

eHealth and COVID-19

The European Commission and the EU countries have defined a common approach for uniform and interoperable proofs of vaccination (vaccination certificates). The Commission and the EU members have also worked together for efficient contact tracing and warning apps.

EU Digital COVID Certificate

A EU Digital COVID Certificate (EU DCC) is a digital proof that a person has been vaccinated against COVID-19, has recovered from COVID-19 or has a test result. Therefore, the EU Digital COVID Certificate refers collectively to 3 types of certificates: vaccination, recovery and test.

Vaccination certificates

As vaccination efforts are progressing in EU countries, vaccinated people receive proofs of vaccination, also called vaccination certificates. They are useful in travel situations, but might also be useful in healthcare situations, especially if a person uses services of different healthcare organisations, possibly in different countries. Most EU Member States now also require EU DCCs to be presented for domestic situations such as access to restaurants, cultural sites and events, workplaces, etc.

Test certificates

The EU’s Health Security Committee has adopted a common standardised set of data to be included in COVID-19 test result certificates. EU Member States frequently require the presentation of negative test results as a condition for waiving restrictions to free movement to prevent the further spread of the virus and its variants.

Recovery certificates

Some Member States have established specific travel rules for people that have recently recovered from the COVID-19 disease. Instead of a test or vaccination certificate, such persons can be requested to present a recovery certificate.

Trust framework and detailed technical specifications

The eHealth Network has published detailed technical specifications describing mechanisms for the interoperability of vaccination, test and recovery certificates (formats and trust management, the EU DCC gateway, 2D barcode, applications, public key certificate governance). In addition, detailed technical structure and value sets to be used in the contents of the EU Digital COVID Certificates are available. Reference implementations are available and have been published as open source.

The technical specifications have been officially adopted as a Commission Implementing Decision (EU) 2021/1073 of 28 June 2021, amended by the Commission Implementing Decision (EU) 2021/2014 of 17 November 2021, 2021/2301 of 21 December 2021 and 2022/483 of 21 March 2022.

Document Signer Certificates (DSC) and Country Signing Certificate Authority (CSCA) certificates are available for download at the EU DCC Trust List page.

The eHealth Network has collaborated with EU agencies, the Health Security Committee, the World Health Organization and other institutions. Additional work is ongoing to further develop the EU Digital COVID Certificate system. Collaboration with third countries and international organisations is continuing with the goal of enabling international interoperability.

Third countries

The EU DCC system is currently in use in all EU Member States, EEA countries as well as many countries outside the European Union. More countries may join the infrastructure after the adoption by the Commission of an ‘equivalence decision’; such decisions are country-specific.

An equivalence decision establishes that COVID-19 certificates issued by a third country apply the standards and technological systems that are interoperable with the EU DCC trust framework allowing for the verification of their authenticity, validity and integrity of the certificates, and which contain the data set out in the Annex to the Regulation (EU) 2021/953. These are to be considered as equivalent to certificates issued by Member States in accordance with the EU DCC Regulation, to facilitate the holders’ ability to move freely within the Union.

The process for joining is described in the Third Country EU Digital COVID certificate Equivalence Decision procedure complemented by three Annexes (I. Evaluation Checklist, II. Technical Procedure, III. Application Form). See also additional information on the Reciprocity and data protection (Word version).

The equivalence decision process

0. Initiation

First contact, pre-checks of readiness, technical clarification

 

1. Self-assessment

Completion and submission of the Evaluation Checklist (with sample QR codes)

Applicant country

2. Technical check

Assessment of Evaluation Checklist

Formal submission of application for Equivalence Decision* (if not submitted already)

Technical screening and Submission of Annex III

European Commission

Applicant country

3. Equivalence Decision

Preparation of Equivalence Decision

Vote in Member State Committee

Adoption and publication as Implementing Act

European Commission

4. Onboarding

Final onboarding with operational tests

Go Live and connection to the EU DCC Gateway

European Commission

Applicant country

* Letter to the European Commission Secretary General, as well as Reciprocity and Data Protection Questionnaire.

Legal texts

Technical specifications

Technical specifications adopted as Commission Implementing Decisions are normative and legally binding. A consolidated version is provided below for ease of reference.

The following technical specifications published as eHN Guidelines provide further explanations and instructions complementing the adopted Commission Implementing Decisions.

Open source reference implementations (ongoing work)
EU DCC Trust List page provides the possibility to download the EU Digital Covid Certificates (EU DCC) Signer Certificates Archive.

Third Country Digital COVID Certificate Equivalence Decision

Contact tracing and warning apps

Mobile contact tracing and warning applications can help reduce the spread of the SARS-CoV-2 and support the gradual lifting of confinement measures by:

  • informing citizens if they have been in proximity of persons infected by the virus (for more than 15 minutes within less than 2 meters) and
  • encouraging citizens to inform their health authorities and ask for support

The European Commission and the EU countries have set up an EU-wide system to ensure interoperability – a so-called ‘gateway’.

This allows Europeans to:

  • travel with one single appwithin the EU, and
  • be warned if they may have been exposed to COVID-19 through prolonged proximity to or close contact with someone who is infected

However, the identity of the COVID infected person will always remain anonymous.

Contact tracing apps are voluntarily installed by citizens and are based on Bluetooth proximity technology that does not enable tracking of people’s locations.

These apps alert people who have been in close proximity to an infected person for a certain duration, so that they can take necessary actions to protect themselves and the people around them, for example, by self-isolating and getting tested. In this way, the infection transmission can be rapidly interrupted.

Nevertheless, app users’ privacyand data must be safeguarded. The national authorities will deactivate the apps at the end of the pandemic, and users are free to uninstall it at any time.

How does the interoperability system work

Users will only need to install one app and will still be able to receive an alert, even if they travel abroad. The gateway server will efficiently receive and pass on random identifiers between national apps thereby keeping the amount of data exchanged to a minimum.

Going forward, more and more European countries will get the opportunity to join the gateway by linking their national contact tracing and warning apps to the system, and by doing so, exploiting the full potential of such apps to break the chain of coronavirus infections across borders and to save lives.

The participating EU countries, represented by the designated national authorities or official bodies arejoint controllers for the processing in the gateway. They must provide users with appropriate information about the processing of their personal data in the European Federation Gateway in accordance with Article 13 of the GDPR (so called 'privacy policy').

To support the joint controllers in complying with their obligations under Article 35 of the GDPR, the European Commission has prepared a document providing information on the European Federation Gateway Service that can be used by the Member States as a component of their respective own Data Protection Impact Assessment for the exchange of personal data via the gateway. In order to protect the security of the processing of personal data, the part of the document describing implemented security measures is not disclosed.

 

Toolbox and interoperability guidelines

EU countries, supported by the Commission, adopted an EU toolboxon 16 April 2020 to use mobile applications for privacy-preserving contact tracing and warning in response to the coronavirus pandemic. On 13 May 2020, the EU countries, with the support of the European Commission, adopted interoperability guidelines for approved contact tracing mobile applications in the EU and on 30 June 2020 a set of technical specifications.

A key principle of the guidelines is that users should be able to rely on a single app wherever they are in the EU. The interoperability gateway service links national contact tracing apps’ backend, which ensures that apps work seamlessly in different EU countries. The modalities for the processing in the gateway are defined in the Commission’s adopted Implementing Decision.

More information