INTRODUCTION
The COVID-19 pandemic has wreaked havoc across nations. The novel coronavirus, caused by SARS-COV-2, has infected more than two crore people and has claimed more than seven lakh lives. Different nations have adopted different means to tackle the virus and its spread, effectively. Developing and imparting Immunity Passports to their citizens is one of the means that some countries have adopted to keep a check on COVID.
‘Immunity passports’ are a theoretical credential – most often digital – through which someone can prove that they have either had the virus and recovered, or have had a vaccination. Immunity passports are being hyped as a solution to ending lockdowns around the world by actors including the proponents of digital identity; the digital identity industry; think-tanks; and the travel industry. Immunity passports would link your identity to a coronavirus test result so you can share your immune status with employers and other third parties[1]. Immunity passports can further be used as an immunity certificate or release certificate too. It can act as a document that assures that the person carrying such a certificate, is immune to any contagious disease. They are legal documents that are given out by the testing authority after a serology test. To get an immunity certificate there are few conditions to be fulfilled.
But scientists say digital immunity passports raise a number of issues, from how immunity is determined to the protection of users’ privacy[2].
CURRENT SCENARIO
Several countries, including the United Kingdom, Italy, Chile, Germany, etc. along with some U.S. states like California, have expressed interest in “immunity passports”, as a system requiring people to present supposed proof of immunity to COVID-19 in order to access public spaces, worksites, airports, schools, or other venues. In many proposed schemes, this proof would be stored in a digital token on a phone. Immunity passports would threaten our privacy and information security and would be a significant step toward a system of national digital identity that can be used to collect and store our personal information and track our location[3]. Requiring people to store their medical test results in a digital format would expose private medical information to the danger of data breaches.
However, the nature of what sort of information would be held on an immunity passport is still not known. The digital identity industry, which is trying and pushing is own products as immunity passport solutions, is vehemently failing in protecting the privacy of its users, and concerns around data breach and collection still remain, thereby raising serious concerns of hence human rights violation. And the failure of the digital ID industry to deal with the issues of exclusion, exploitation, and discrimination puts the entire industry under question. They are interested in building wider digital identity ecosystems, based on their pre-existing models, rather than developing a genuine solution to overcome the risks associated with these passports.
IMMUNITY PASSPORTS AND DIGITAL IDENTITY – THE CONCEPT
Immunity passports have become a much-hyped tool to cope with the pandemic and the economic crisis which it has led to. Essentially, with immunity passports, those who are “immune” to the virus would have some kind of certified document – whether physical or digital. This ‘passport’ would give them rights and privileges that other members of the community do not have. Identity systems are complex systems that can alter the relationship between the individual, the state, and all the companies and agencies who are granted power in between.
However, proponents of immunity passports don’t yet know the extent of the problem they are solving. In fact, these passports have led to a series of problems, which they have either failed to take note of or have refused to do anything about it, in the name of profit and recognition.
The scientific validity of immunity is disputable when we talk of COVID, and related vaccines or similar solutions. It is too early to start designing a system without a better understanding of immunity. The following crucial questions regarding immunity have to be answered first:
- How and in what ways immunity to the virus is conveyed?;
- What a testing regime would look like? For example, is it home-based or does it require a lab? Is it something that can be rolled out at scale quickly to broad populations or is it only accessible to some?;
- How long does immunity last?; and
- What are the prospects for a vaccine, how long will it last, and how will it be deployed?
It is pertinent to understand these issues in order to design a system that works both, in terms of giving the information that’s needed for public health reasons, and for managing the future course of action to manage lockdowns including the associated economic and social strains with it. All this has to be achieved while ensuring that the fundamental rights of citizens, including the Right to Privacy, are not hampered. Once understood, it would be easier to determine the exact purpose behind developing such identity systems. It would not be possible to say what the design should be, without the knowledge of how immunity works.
ISSUES RELATED TO IMMUNITY PASSPORTS
Travel firms and airports, governments, policy think-tanks, and the digital identity industry are terming immunity passports as a potential game-changer. ID2020 is an alliance of organizations pushing for digital identity – including businesses like Microsoft and biometrics companies. The Executive Director of ID2020[4] in a paper titled Immunity Certificates: If We Must Have Them, We Must Do It Right, wrote that, with the deployment of immunity certificates systems becoming increasingly likely, there is a significant value to proactively exploring the concept and ensuring that adequate safeguards, both technical and regulatory, are implemented. The CEO of Yoti, a key digital identity market player, has stated[5] that it is technically simple to move from their existing work in this area to providing immunity certificates. Yoti has released a ‘Code of Practice’[6] for the sharing of personal health credentials. However, Yoti’s own existing app passes its own test with flying colors.
The Tony Blair Institute for Global Change has continued to push for this issue, taking one of the more extreme stances on immunity passports.[7] They have stated that a digital credential should be implemented prior to the development of accurate antibody testing, thereby stating, that digital identity should be rolled-out immediately based on antigen testing, and be ready for, if and when antibody testing becomes available. That would mean people could get a credential because they tested positive for the virus, rather than because they have some specific level of antibodies which could create an immune response. Digital identity companies are keen on the promotion of digital identity to be the ‘remedy’ to effectively manage the lockdown measures and contain the spread of the virus.
In the case of immunity passports, it would be a question of having a test result or a vaccination from a verified lab or provider. Those looking to see the credential would be able to trust that the certificate of ‘immunity’ was from a trusted source. These digital identity systems often set themselves apart from state systems – like Aadhaar in India, with its single giant biometric database of over a billion people. However, the industry’s digital identity solutions are not necessarily more advance, or safe, when it comes to ensuring privacy than the government systems, and the same remains a major issue.
The effectiveness of ‘immunity passports’ has been questioned by leading authorities in health. WHO has been explicit about the current state of affairs, when it comes to these kinds of immunity systems.[8] Research from Imperial College London highlights the challenges in the testing of antibodies that would lead to immunity passports; researchers identified that there are dangers present if non-immune people end up receiving a passport. They also noted that some presentations of the disease, for example, young people and those with mild symptoms, might not be able to qualify for a passport. They also reiterate the WHO’s point that it remains unknown as to whether the presence of antibodies actually protects people from further infection.[9]
It is also unknown as to how long any immunity actually lasts. Therefore, any technical choice, such as immutable ledgers and blockchain would be inappropriate, since these are more of permanent solutions, which can’t be easily modified or changed, as and when the immunity changes.[10]
These uncertainties and variances make immunity passports legally dubious. A leading human rights firm in the UK says that there is no basis on which it could be said that immunity passports are strictly necessary, appropriate, and proportionate to the objective of managing and monitoring the spread of COVID-19, let alone a pandemic.[11] Immunity passports bring together the worlds of identity and public health. While the goal may be to have an immunity passport system that is available to everyone, in practice this will likely be a far-fetched dream, which is demonstrated through patterns of historical exclusion, reflected in identity systems[12] and the modern realities.[13] It would be unprecedented for a combined system for identity and health system to not unfairly target or exclude people. Health systems already exclude many people or create unintentional hierarchies in society. The social risks of immunity passports are huge. It would serve as a route to discrimination and exclusion, particularly if the power to view these passports falls on people’s employers or the police.
IMMUNITY PASSPORTS – WHY EXACTLY IS IT PROBLEMATIC?
People who face compounded social disadvantage could likely face greater challenges to their physical and mental health and well-being if “immunity passports” or “risk-free certificates” become mandatory. Other individuals may also be refused these certificates because they are deemed at a ‘higher risk’ than others. These include people with chronic illness, those who have had an organ transplant, people who have received chemotherapy or antibody treatment for cancer, those who have blood or bone marrow cancer such as leukemia, those who have a severe lung or heart condition, and pregnant women.[14] In fact, the current pandemic importantly intersects with other pre-existing health conditions. Moreover, “risk- free certificates” rely on the assumption of a clear disease trajectory and effective public health infrastructures, but efface ongoing disruptions to health over time – neglecting the emergence of chronic illness as a consequence of COVID-19. Further, work is needed to define how COVID-19 relates to other illnesses, and indeed to redefine what “health” means as a whole, thereby also reflecting on what “fit to work” or “infectious/immune” means in this context.
In terms of privacy, it remains unclear how the results of antibody testing will be collected, how identifiable such data will be, for what purposes will it be used, with whom it will be shared and under what circumstances, etc. Public trust, solidarity, and addressing social injustices are key factors to the success of testing, contact tracing, quarantine of contacts, and isolation of cases.[15] However, immunity passports may intersect with pre-existing state-surveillance practices, particularly of marginalized groups.[16] This may lead to public distrust, division, and more injustices. Furthermore, rewarding immunity with freedom of movement, including the ability to return to school and work, is a particular style of biopolitics that may increase instead of mitigating risk. Some individuals may intentionally try to contact COVID-19 in order to obtain “risk-free certificates” to enable them to re-enter the workforce.[17]
Immunity passports would impose an artificial restriction on who can, and cannot participate in social, civic, and economic activities and might create a perverse incentive for individuals to seek out infection, especially people who are unable to afford a period of workforce exclusion, compounding existing gender, race, ethnicity, and nationality inequities.[18] Such behavior would pose a health risk not only upon these individuals but also upon people they come in contact with. In countries without universal access to health care, those most incentivized to seek out infection might also be those unable or understandably hesitant to seek medical care due to cost and discriminatory access.[19] Furthermore, immunity passports risk alleviating the duty on governments to adopt policies that protect economic, housing, and health rights across society by providing an apparent quick fix.
CONCLUSION
Digital identity and immunity passports seem inevitable to control the pandemic; as a part of a comprehensive response to the pandemic. However, digital identity may actually extend the risks of societal harms that come along with immunity passports. The push for their pre-existing solutions reveals an industry interested in pushing their own agenda, rather than a solution to the crisis.
The processing of personal data associated with immunity passports must align with national and international obligations on data protection and the right to privacy and uphold data protection principles of fairness, transparency and lawfulness, purpose specification, minimization – legality, necessity and proportionality, accuracy, storage limitation, and confidentiality and integrity. Due consideration must be given to other types of harms and threats including exclusion and discrimination as well as targeting and profiling, and meaningful safeguards, monitoring, and auditing for digital identity and immunity passports should be established. The utilization of immunity passports must be clearly articulated, and they must be firewalled from being used for other purposes.
The private sector must commit, to not be leveraging an immunity passport to broader digital identity solutions, to promote their own services and products and should not deploy any technological solution until it is supported by the epidemiological evidence.
RECOMMENDATIONS
Digital identity seems like it would ensure an immunity passport program that is trade-proof, privacy-centric, user-friendly, and scalable. It would mean taking a real-life identity to create a digital identity; associating that digital identity to an immunity certificate and; finally confirming the original person is the one claiming to own the immunity certificate in the real world by authenticating their biometrics when presenting the immunity certificate.
Within the context of a digital identity solution, different successive configurations could be adopted to solve multiple problems of digital identities and alike:
- Biometrics only, i.e. tying to the physical self by associating a user’s face to an immunity certificate stored on their personal device;
- Enabling remote authentication via a registration process tied to a decentralized network;
- Adding a legal identity document for greater trust as to the authenticity of the person claiming immunity.
- In the immunity passport use case, the cost of bad actors is high, meaning a digital identity solution built to serve it must be trusted. A combination of photo ID bound to the facial biometric offers the highest level of assurance that the person is who they claim to be at enrolment.
- Throughout each step, it is still essential to consider the trade-offs required to uphold the individual’s privacy rights as it relates to data creation, storage, use, and ultimately, deletion.
This Article Can Be Cited As
Amrith R, Why the Concept of Immunity Passports and Digital Identity is Problematic, Metacept- InfoTech and IPR, accessible at https://metacept.com/why-the-concept-of-immunity-passports-and-digital-identity-is-problematic/.
REFERENCES
[1] https://www.cnbc.com/2020/06/03/coronavirus-experts-warn-digital-immunity-passports-are-unethical.html
[2] https://www.cnbc.com/2020/06/03/coronavirus-experts-warn-digital-immunity-passports-are-unethical.html
[3] https://www.eff.org/deeplinks/2020/05/immunity-passports-are-threat-our-privacy-and-information-security
[4] https://ethics.harvard.edu/files/center-for-ethics/files/safracenterforethicswhitepaper8_1.pdf
[5] https://www.bbc.co.uk/news/technology-52807414
[6] https://www.yoti.com/blog/global-code-of-practice-sharing-personal-health-credentials/
[7] Available at https://institute.global/policy/digital-identity-missing-piece-governments-exit-strategy
[8] Available at https://www.who.int/news-room/commentaries/detail/immunity-passports-in-the-context-of-covid-19
[9] Available at https://www.imperial.ac.uk/media/imperial-college/medicine/mrc-gida/2020-04-23-COVID19-Report-16.pdf
[10] Available at https://medium.com/berkman-klein-center/the-dangers-of-blockchain-enabled-immunity-passports-for-covid-19-5ff84cacb290
[11] Available at: https://www.matrixlaw.co.uk/wp-content/uploads/2020/05/Covid-19-tech-responses-opinion-30-April-2020.pdf
[12] Available at https://privacyinternational.org/long-read/2544/exclusion-and-identity-life-without-id
[13] Available at https://privacyinternational.org/explainer/2670/understanding-identity-systems-part-2-discrimination-and-identity
[14] Who’s at higher risk from coronavirus. Retrieved from https://www.nhs.uk/conditions/coronavirus-covid-19/people-at-higher-risk-from- coronavirus/whos-at-higher-risk-from-coronavirus/ last
[15] A. L. (2020). COVID-19 immunity passports and vaccination certificates: scientific, equitable, and legal challenges. The Lancet. Retrieved from: DOI:https://doi.org/10.1016/S0140-6736(20)31034-5
[16] Kofler N. and Baylis, S. (2020). Ten Reasons Why Immunity Passports Are a Bad Idea. Nature 21 May 2020. Retrieved from https://www.nature.com/articles/d41586-020-01451- 0?fbclid=IwAR1X5duOdn5alKTxONXhIt1wlWhsuQ7TqTdczPpNoCZisMi_EHEfaDCceR M
[17] Bauer, G. (2020). Please, Don’t Intentionally Infect Yourself. Signed, an Epidemiologist. The New York Times. Retrieved from https://www.nytimes.com/2020/04/08/opinion/coronavirus-parties-herd- immunity.html?action=click&module=Opinion&pgtype=Homepage
[18] Chinazzi M, Davis J, Ajelli A, et al. The effect of travel restrictions on the spread of the 2019 novel coronavirus (COVID-19) outbreak. Science 2020; 368: 395–400.
[19] Worsnop CZ. Concealing disease: trade and travel barriers and the timeliness of outbreak reporting. Int Stud Perspect 2019; 20: 344–72.
