Legal ‘sunset clauses’ should be used to limit use of COVID certificates to current pandemic

“Sunset clauses” should be introduced into relevant legislation to limit the use of coronavirus certificates to just the current pandemic and not beyond, a study warns.

Legislation should set a clear expiry date for the passes to prevent the normalization of the current level of interference with individuals’ privacy, and to stop the technical infrastructure used for COVID-19 certificates being repurposed for broader uses after the pandemic, an expert has said.

The research, published in the journal Big Data and Society, by Professor Ana Beduschi from the University of Exeter Law School, says the legislation providing the legal basis for the deployment of certificates must clarify key questions concerning data access, purpose limitation and data storage conditions.

The research was funded by the Economic and Social Research Council (ESRC) as part of UK Research & Innovation (UKRI)’s rapid response to COVID-19

Professor Beduschi said: “Currently, COVID-19 health status certificates are being deployed around the world, including in Europe, the United States, and China. Yet, most countries in the Global South, where vaccination rates are low, have not yet fully implemented such certificates.

“While mandating COVID-19 certificates may contribute to the management of the pandemic, technical solutions for the verification of COVID-19 health status do not suffice on their own. Because technologies do not evolve in a legal vacuum, the existing laws and regulations must be respected.”

Professor Beduschi urges governments to process health data securely and confidentially, ensuring the prevention of any unauthorized access, accidental loss, damage or destruction of the data. If breaches were to become widespread, they would undermine societal trust in these certificates.

Professor Beduschi said: “Limiting the duration of the usage of COVID-19 certificates also clarifies that measures adopted during the pandemic are only justified within the exceptional circumstances of the present health crisis. Such an approach would set a clear precedent in favor of safeguarding individuals’ right to privacy in the event of a future pandemic.”