Implementation of Digital Certificates (COVID Passport)

The following is a summary of discussions held with the EU COM Services, alongside relevant information, regarding the introduction of Digital Covid Certificates within the EU as from 1 July.

In order to facilitate a re-opening of personal cross-border mobility, the European Union have developed Digital Covid Certificates (DCC), which will check travellers against pre-defined criteria, to determine if they are eligible to enter another EU Member State.

Interferry warmly welcomes the Digital Covid Certificates as a tool to facilitate free movement and to encourage countries to do their utmost both to convey this solution and to get their systems in place and to communicate to their passenger oriented international travel industries.

The basic principle is that a person who has:

• been vaccinated against COVID-19, or

• has recovered from COVID-19, or

• can produce a negative test result…

shall be allowed admittance for intra-EU travel. Also several 3rd countries, like the UK, have signed up for this scheme.

The plan is for DCC-checks to be operational on 1 July, but ultimately the details of its implementation are up to the individual Member State, offering a potentially complex picture for operators servicing several markets.

Interferry has been engaged with the EU COM Services, trying to get a handle on which information is needed for operators to be able to link into this new set-up. While the picture is still fluid, the main source of information is found at https://ec.europa.eu/health/ehealth/covid-19_en – providing a comprehensive overview of the Certificate itself, the underlying systems for checking the passenger’s QR-code, and how to link up to the relevant dataset to verify the validity of the QR-code.

While the IT-infrastructure seems relatively accessible through the aforementioned link, the EU COM has made it clear that it is up to the individual Member State to define the requirements for the operators, unfortunately indicating that the EU COM again shows that while trying, the EC is not able to claim operational sovereignty over the pandemic.

On a direct question to the EU COM Services, the answer was that ferry operators need to reach out to their respective administrations asking for detailed instructions on what measures need to be put in place to be able to make full use of the 01 July introduction of the pan-EU DCCs. Such measures include gaining access to the public keys containing information on the DCCs and how to ensure that the operator can comply with GPRD or other data protection requirements.

Questions asked on Digital Certificates: EU COM and Interferry

When the Digital Certificates are put into practice, what is expected from the operators in terms of verification of the Certificate? Do we need to check the existence of a Certificate and that it is valid?

First of all, it should be noted that already now a number of Member States require transport operators to implement certain public health measures during the pandemic. Regarding specifically the verification of EU Digital COVID Certificates (EUDCC), it is for each Member States to decide if it requires EUDCCs to be verified and, if so, who should carry out such a verification and what kinds of checks the verification would entail.

In the event that Member States require transport operators to carry out the verification, the transport operator is required to integrate the verification into the operation of cross-border transport infrastructure such as airports, ports and railway and bus stations, where appropriate. This is set out in Article 3(9) of the Regulation governing the EUDCC. We have called upon Member States to ensure complete and timely information of transport operators about their (possible) obligations under national law. We advise transport operators to proactively reach out to the transport authorities of all Member States relevant for their operations.

Does the QR code have to be scanned? How do we gain access to the software / database linked to the QR code? Is there any other way to verify?

To verify the authenticity, integrity and validity of the EU Digital Covid Certificate (DCC), it will be necessary to scan the QR code. The Commission has developed an open source and open standard reference implementation for Member States; some have built their verification apps based on the reference implementation, others have built their own. The specifications and standards are published on the Commission’s website: https://ec.europa.eu/health/ehealth/covid-19_en

The QR code is digitally signed by the certificate issuer; to read the QR successful, the verifier must have the public key that is paired with the issuer’s private key. The public keys are exchanged between the Member States; If a Member States imposes the obligation to verify the certificates on transport operators, it needs to give those operators the tools to verify the QR Code.

Will Country B by default have to accept the admittance of a passenger from Country A, given that the passenger has a Certificate? Or could Country B say no due to its own policies? We believe that the EU should be much more vocal in expressing that as from 1 July, Europe is open again (to holders of the Certificate).

The EUDCC is a document that facilitates and harmonizes the proof of vaccination, negative test or recovery from COVID-19. It is not a travel document. The Regulation makes it clear that when a Member States accepts certificates of vaccination, test or recovery, the Member State must in principle refrain from imposing additional travel restrictions (e.g. travel-related testing or quarantine/self-isolation). Such additional travel restrictions can only be imposed if they are necessary and proportionate to safeguard public health in response to the COVID-19 pandemic.

The recently updated Council Recommendation 2020/1475 on a coordinated approach to free movement restrictions in response to the COVID-19 pandemic sets out in more detail how Member States should apply this provision in a consistent and coordinated manner. The Council Recommendation updating Council Recommendation 2020/1475 can be found here: https://data.consilium.europa.eu/doc/document/ST-9603-2021-INIT/en/pdf; https://www.consilium.europa.eu/en/press/press-releases/2021/06/14/covid-19-council-updates-recommendation-on-free-movement-restrictions/

Do we have to keep the proof of a control, do we have to register that we have done control?

This is up to the Member State to decide.

What about interoperability with non EU countries as UK, is there any overview?

Up-to-date information is found at https://reopen.europa.eu/en/

Is there a list of apps which can check digital certificate?

We have been informed that several MS have developed / are developing apps, but we have not been able to retrieve any overview.

How to manage passengers without QR code (vaccination prior to delivery of certificate, vaccination or test done in a non-EU country)?

This is up to the Member State to decide.