EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery

7 Internationa l Data Transfers ................................ ................................ 14 Adopted 4 The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Dec ision No 1247/2002/EC, Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018, Having regard to the request for a Joint Opinion of the Euro pean Data Protection Supervisor and of the European Data Protection Board of 17 March 2021 regarding the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable c ertificates on vaccination, testing and recovery to facilitate free movement during the COVID - 19 pandemic (Digital Green Certificate), HAVE ADOPTED THE FOL LOWING JOINT OPINION 1 BACKGROUND TO THE PR OPOSALS 1.

On 17 March 2021, the Commission published the Propo sal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID - 19 pandemic (Dig ital Green Certificate) (“the Proposal”). The Proposal and its Annex are enacted pursuant to Article 21(2) of the Treaty on the Functioning of the European Union (“TFEU”), according to which every EU citizen has the right to move and reside freely within t he territory of the Member States 1 , subject to the limitations and conditions laid down in the Treaties and by the measures adopted to give them effect. 2. On 17 March 2021, the Commission also published the Proposal for a Regulation of the European Parliamen t and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to third - country nationals legally staying or residing in the territories of Member States during the COVID - 19 pandemic (Digital Green Certificate) (“the Second Proposal”).

The Second Proposal is enacted pursuant to Article 77(2)(c) TFEU , according to which the Union shall develop policies setting out the conditions under which nationals of third countries shal l have the freedom to travel within the Union. 3. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) note that the Proposals aim to facilitate the exercise of the right to free movement within the EU during the COVID - 19 pandemic by establishing a common framework for the issuance, verification and acceptance of interoperable certificates on COVID - 19 vaccination, testing and recovery, entitled “Digital Green Certificate”. 1 References to “Member States” made throughout this document should be understood as references to “EEA Member States”, and references to the "EU" should be understood as references to the "EEA". Adopted 5 4. The Proposal states that, in order to limit the spread of the virus, Member States have adopted various measures, some of which have had an impact on Union citizens’ right to move and reside freely within the territory of the Member States, such as restrictions on entry or requirements for cross - border travelers to undergo quarantine 2 .

It also notes that many Member States have launched or are planning to launch initiatives to issue vaccination certificates 3 . 5. The EDPB and the EDPS also note that the Proposals require all EU Member States to use the Digital Green Certificate framework and issue certificates for the purpose of facilitating the exercise of the right to free movement within the EU during the COVID - 19 pandemic. 6. On 17 March 2021, the Commission requested a Joint Opinion of the EDPB and the EDPS on the basis of Article 42(2) of Regulation (EU) 2018/1725 (“EUDPR”) 4 on the Proposal and the Second Proposal (jointly “the Proposals”). 2 SCOPE OF THE JOINT O PI NION 7. The Proposals are of particular importance due to their major impact on the protection of individuals’ rights and freedoms with regard to the processing of their personal data. The scope of this Joint Opinion is limited to the aspects of the Proposals relating to the protection of personal data, which represent a fundamental aspect of the Proposals.

8. For the sake of clarity, as the second Proposal is limited to ensuring that EU Member States apply the rules laid down in the Proposal to the third country nationals, but who reside or stay legally in their territory and are entitled to travel to other Member States in accordance with Union law, the EDPB and the EDPS will provide its recommendations with a focus on the Proposal. This being said, the general comments and considerations made in this Joint Opinion are fully applicable to both Proposals. 9. Not entering into other important ethical and societal aspects on which the Proposal may have an impact in terms of compliance with fundamental rights, the EDPB and the EDPS highlight that it is essential that the Proposal is consistent and does not conflict in any manner with the application of the General Data Protection Regulation (“GDPR”) 5 . This is not only for the sake of legal certainty, but also to avoid th at the Proposal has the effect of directly or indirectly jeopardizing the fundamental right to the protection of personal data, as established under Article 16 TEFU and Article 8 of the Charter of fundamental rights of the European Union (“the Charter”).

10. I n particular, in this Joint Opinion, the EDPB and the EDPS will point out the areas where the Proposal requires further alignment with the EU data protection framework, also with a view of avoiding the legal uncertainty that would arise if these are not ad dressed in the adopted legislation. 2 See Recital 3 of the Proposal. 3 See Recital 8 of the Pro posal. 2018, p. 39). 2016, p. 1. Adopted 6 11. The EDPB and the EDPS are aware of the ongoing legislative process of the Proposal and stress their availability to the co - legislators to provide further advice and recommendations throughout this process and to ensure i n particular: legal certainty for natural persons, due protection of personal data for data subjects in line with the TFEU, the Charter and data protection legislation. 3 PRELIMINARY CONSIDER ATIONS 12. The EDPB and the EDPS recall that data protection does not c onstitute an obstacle for fighting the current pandemic 6 .

Moreover, compliance with data protection law will help citizens’ trust towards the framework created by Proposal. At the same time, the EDPB and the EDPS suggest the Commission to take a holistic a nd ethical approach to the Proposal in order to encompass all the issues related to privacy and data protection and fundamental rights in general . Moreover, as previously stressed, the general principles of effectiveness, necessity 7 , and proportionality 8 must guide any measure adopted by Member States or EU institutions that involve processing of personal data to fight COVID - 19 9 . 13. The European Council , in its statement of 25 February 2021, called for a common approach to vaccination certificates . It also w elcomed the adoption of the two Council recommendations on travel within, and into, the EU, according to which restrictions can be introduced in accordance with the principles of proportionality and non - discrimination and taking into account the specific s ituation of cross - border communities.

10 14. The EDPB and the EDPS highlight that a clear distinction should be made between “vaccination certificate”, which corresponds to the attestation given to a person that has received a COVID - 19 vaccine, and the term “imm unity certificate”. In this regard, we note that, at the time of preparation of this Joint Opinion, there seems to be little scientific evidence supporting the fact that having received a COVID - 19 vaccine (or having recovered from COVID - 19) grants immunity and how long it lasts. Therefore, the Digital Green Certificate should be understood merely as a verifiable proof of a timestamped factual medical application or history that will facilitate the free movement of EU citizens due to its common format in all Member States. However, we caution to derive conclusions for immunity or contagiousness, as a consolidated scientific opinion is yet outstanding. 15. ) national authorities and 6 See EDPB Statement on the processing of personal data in the context of the COVID - 19 outbreak .

Adopted on 19 March 2020. 7 See Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit , 11 April 2017. 8 See EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data , 19 December 2019. 9 See Guidelines 04/2020 on the use of location data and contact tracing tools in the c ontext of the COVID - 19 outbreak para. 4; see also EDPB Statement on the processing of personal data in the context of the COVID - 19 outbreak , 20 March 202 0. eu/en/press/press - releases/2021/02/25/statement - of - the - members - of - the - european - council - on - covid - 19 - and - health - 25 - february - 2021/ . int/news - room/articles - detail/interim - position - paper - considerations - regarding - proof - of - covid - 19 - vaccination - for - international - travellers .

” 16. In the context of ongoing discussions, the EDPB and the EDPS acknowledge that, at the time of issuance of this Joint Opinion, diverging views exist as to the potential risk of discrimination arising from the use of vaccination certificates 12 . While the P rop osal is not limited to the vaccination certificates to mitigate the risk of discrimination, the EDPB and the EDPS underline the lack of an impact assessment accompanying the Proposal , that would provide substantiation as to the impact of the measures being adopted as well as to the effectiveness of already existing less intrusive measures . 17. At the same time, the EDPB and the EDPS also acknowledge that the current emergency situation caused by the COVID - 19 pandemic has led to real and important risks, both fo r the exercise of the right of free movement within Member States and for public health due to the lack of a common approach towards interoperable certificates.

Moreover, as put forward by Europol, a high risk relating to the forgery and illicit sale of fa lse COVID - 19 test certificates exists 13 . In accordance with the Proposal, the Digital Green Certificate shall mitigate these risks by harmonising the documentation and adopting a number of security measures related thereto. Furthermore, it has to be conside red that the introduction of the Digital Green Certificate will not eliminate the risk for forgeries and therefore, it must be accompanied by the adoption of adequate technical and organisational measures safeguarding against manipulation and falsification of the certificates. 18. Taking into account the above considerations, the EDPB and the EDPS acknowledge the legitimate objective of the Proposal of harmonising the documentation relating to the issuance, verification and acceptance of the Digital Green Certi ficate within the EU with the aim of enabling the free movement of citizens between EU Member States.

eu/early - warning - notification - illicit - sales - of - false - negative - covid - 19 - test - certificates . Adopted 8 to fight the COVID - 19 pandemic. At the same time, the EDPB and the EDPS request the Commission to clarify that Member States should accept all three types of certificates. Should this not be the case, a clear discrimination based on health data would occur, thus resulting in a breach of fundamental rights. 20. The EDPB and the EDPS also highlight that the deployment of the Digital Green Certificate must in any event also contemplate measures to identify and mitigate the risks that may result from the use of the framework and the issuance of the Digital Green Certificate, including possible unintended secondary uses without a proper legal basis established at national level, that respects Articles 7 and 8 of the Charter and is in full compliance with the GDPR, as will be explained in detail in the next c hapter.

LEGAL FRAME WORK 21. ” In accordance with this, compliance with the principles of necessity and proportionality by the measures introduced with the Proposal s hould carefully be analysed . In particular, the Proposal should achieve a fair balance between the objectives of general interest pursued by the Digital Green Certificate and the individual interest in self - determination, as well as the respect for her/his fundamental rights to privacy, data protection and non - discrimination, and other fundamental freedoms, such as freedom of movement and residence. 22. The Commission substantiates the proportionality of the Proposal on the fact that the latter limits the proce ssing of personal data to the minimum necessary, by only including a limited set of personal data on the certificates to be issued (Article 5 and Annex of the Proposal); by setting out that the data obtained when verifying the certificates should not be re tained (Article 9); and by establishing a framework that does not require the setting up and maintenance of a central database.

Moreover, the Proposal clarifies that the Digital Green Certificate and its trust framework will have a temporary nature, since it should be suspended by means of a delegated act by the Commission once the COVID - 19 pandemic has ended (Article 15(2) of the Proposal) and given that, as of that point in time, there would be no justification requiring citizens to present health documen ts when exercising their right to free movement. 23. The EDPB and the EDPS consider that, given the nature of the interference of the measures put forward by the Proposal, any possible further use of the framework and the Digital Green Certificate on the basis of Member State law, other than the one of facilitating the right to free movement between EU Member State s , falls outside of the Proposa l 14 , and consequently of the EDPB EDPS Joint Opinion. 24. The EDPB and the EDPS nonetheless consider that, should Member S tates still seek to implement the Digital Green Certificate on the basis of Member State law for any possible further use than the intended purpose of facilitating free movement between EU Member States, this may lead to unintended consequences and risks t o the fundamental rights of EU citizens.

Indeed, the extension of the application of the Digital Green Certificate to other situations to ease the restrictions currently in 14 See Recital 37 of the Pr oposal. g. to enter shops, restaurants, clubs, places of worship or gyms or to use it in any other context as in the employment context. Any such further use of the Digital Green Certificate and its associated framework under a national legal basis should not legally or factually lead to discrimination based on having been (or not) vaccinated or recovered from COVID - 19. For this reason, th e EDPB and the EDPS highlight that any possible further use of the framework, the Digital Green Certificate and personal data related to it at Member States level must respect Articles 7 and 8 of the Charter and must be in compliance with the GDPR, includi ng Article 6(4) GDPR 15 . This implies the need for a proper legal basis in Member State law, complying with the principles of effectiveness, necessity, proportionality and including strong and specific safeguards implemented following a proper impact assessm ent, in particular to avoid any risk of discrimination 16 and to prohibit any retention of data in the context of the verification process.

Moreover, the EDPB and the EDPS emphasize that such system need to be integrated into a comprehensive health policy. Th e EDPB and the EDPS consider that such a legal basis in Member State law should at the very least include specific provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entities that can ver ify the certificate as well as the relevant safeguards to prevent abuse, taking into account the risks for the rights and freedoms of data subjects 17 . As clarified by the CJEU, the need for safeguards is all the greater where personal data is subject to aut omated processing and where the protection of the particular category of personal data that is sensitive data is at stake 18 . 25. As the legal basis for any further processing will depend on its compatibility with the legal basis set in its primary purpose at EU level, the EDPB and the EDPS recall the importance of clearly defining the purpose(s) of the Digital Green Certificate in the Proposal.

As stated by the Court of Justice of the European Union (“the CJEU”) (Grand Chamber), in the Digital Rights Ireland Jud gment of the 8 April 2014, and in particular, its para. ) Directive 2006/24 does not contain substantive and procedural conditions relating to the access of the competent national authorities to the data and to their subsequent use. " [emphasis added] 26. e. the quality of the law 19 . In this regard, we consider 15 Article 6(4) GDPR permits processing of personal data for a purpose other than which the data has been collected on the basis of a Union or Member State law, which constitutes a necessary and proportionate measure in a democratic society to safeg uard the objectives referred to in Article 23(1) GDPR. 16 The EDPB and the EDPS are of the view that Member States should notably take into account the risk of discrimination that could result from different levels of availability and access to vaccines fo r individuals in the EU, availability at low costs of testing as alternative to vaccination, etc.

17 For further examples of safeguards see the EDPB Guidelines 10/2020 on restrictions under Article 23 GDPR. o, Joined Cases C - 511/18, C - 512/18 and C - 520/18, 6 October 2020, ECLI:EU:C:2020:791, at paragraph 132. 19 As stated in the Opinion of Advocate General Mengozzi, ECLI:EU:C:2016:6 56, para. 193 on the draft Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data: “According to the case - law of the ECtHR, that expression requires, in essence, that the measure in question be Adopted 10 that the Proposal could better define the purpose of the Green Digital Certificate and provide for a mechanism for the monitoring of the use of the certificate (as composed of the three sub - certificates) by Member States. 27. T he EDPB and the EDPS highlight that the Digital Green Certificate will not only contain the sensitive information r evealed in the document itself, but also sensitive information that may be drawn by inference.

In this regard, for example, given the diversified status of the vaccination stages in the different Member States and the order of priority, it may be easily in ferred that a young person that has been vaccinated when others in the same age category have not, has a trait that justifies getting an early vaccination such as being immunocompromised or having a chronic disease 20 . 28. Moreover, the EDPB and the EDPS are of the view that the Proposal must expressly provide that access and subsequent use of the data by Member States once the pandemic has ended is not permitted under the Proposal and provide for clear indications in this regard (including a clear review and sun set clause for the use the Framework and the Green Digital Certificate, and the involvement of health care scientific monitoring bodies issuing formal advice in the context of the use of the certificate(s)). 29. Finally, the EDPB and the EDPS consider that rec ital 42 and Article 15 of the Proposal must also be amended in order to rule out any future use of the Digital Green Certificate once the pandemic has ended and limit the scope of the Proposal to the current COVID - 19 pandemic and SARS - CoV - 2 virus.

In this regard, the EDPB and the EDPS oppose to the open door included in Article 15 of the Proposal, whereby the Commission, by means of a delegated act, may declare the further application of the Proposal in the future if the WHO would declare a public health em ergency of international concern in relation to SARS - CoV - 2, “ a variant thereof, or similar infectious diseases with epidemic potential ” . The EDPB and the EDPS consider appropriate the deletion of th e underlined wording of the provision in order to comply w ith the principle of purpose limitation, and limit the scope of the Proposal to the current COVID - 19 pandemic and to the purpose of facilitating the free movement of persons (to be further defined and accompanied by safeguards, as specified in this, albeit not exhaustive, Joint Opinion) within the current situation. accessib le and sufficiently foreseeable , or, in other words, that its terms be sufficiently clear to give an adequate indication as to the circumstances in which and the conditions on which it allows the authorities to resort to measures affecting their rights und er the ECHR ” (emphasis supplied).

In this regard, see also ECtHR, Catt v The United Kingdom, 24 January 2019, para. 6 of the concurring opinion of Judge Koskelo joined by Judge Felici, “the general principles of data protection law, such as those requiring that the data to be processed must be adequate, relevant and not excessive in relation to that purpose, become diluted, possibly to the extent of practical irrelevance, where the purpose itself is left without any meaningful definition or limitation. ” (em phasis added). 20 See Cofone N. abstract_id=3767301 . 1 General comments 30. Firstly, the EDPB and the EDPS highlight that this Proposal does not allow for - and must not lead to - the creation of any sort of personal data central database at EU level under the pretext of the establishment of the Digital Green Certificate framework. 31. )”. In this regard, the EDPB and the EDPS recommend to clarify in the Proposal whether the Digital Green Certificate will be automatically created but only provided upon request of the data subjec t, or whether this will only be issued upon request of the data subject.

32. Furthermore, the EDPB and the EDPS consider that the certificates should necessarily be available both in digital and paper - based formats, to ensure the inclusion of all citizens. 2 of the Proposal in this regard. 33. , vaccination certificate, test certificate and certificate of recovery). Moreover, Recital 38 of the Proposal provides that “[i]n line with the principle of minimisation of personal data, the certificates should only contain the personal data necessary for the purpose of facilitating the exercise of the right to free movement within the Union during the COVID - 19 pandemic ”. 34. The EDPB and the EDPS acknowledge that Recital 37 of the Proposal pr ovides Articles 6(1)(c) and 9(2)(g) of GDPR as the legal basis for the processing of personal data, for the issuance and verification of the interoperable certificates . The EDPB and the EDPS, in this regard, recommend to also include the aforementioned leg al basis or, alternatively, a reference to compliance with the GDPR, in the main text of the Proposal, inter alia in Article 1, second paragraph, and in Article 8(2)(b) of the Proposal.

35. Pursuant to R ecital 39 of the Proposal , “[f ]or the purposes of this Re gulation, personal data may be transmitted/exchanged across borders with the sole purpose of obtaining the information necessary to confirm and verify the holder’s vaccination, testing or recovery status” . The EDPB and the EDPS note that, in terms of inter operability, the terminology “personal data” should be further specified, in particular by aligning it to the eHealth Network Guidance in that regard. In line with data protection by default, verification techniques not requiring transmission of personal d ata shall be employed by default whenever technically possible. 36. The EDPS and the EDPS note that Recital 47 of the Proposal must be adapted in order to reflect the request from the Commission for a Joint consultation to EDPS and EDPB in line with Article 42 (2) EUDPR. 37. The EDPB and the EDPS welcome that Article 3(3) of the Proposal enables the citizens to obtain free of charge certificates as well as new certificates if the personal data contained in the Digital Green Certificate is not or no longer accurate or up to date, or the certificate is no longer available to the holder.

The EDPB and the EDPS recommend clarifying in this provision that the certificate as well as its modifications shall be issued upon request of the data subject . Adopted 12 38. Finally, the EDPB and the EDPS note that the additional definition of ‘interoperability’ of Artic le 2(6) of the Proposal lacks clarity, insofar as the Digital Green Certificates are based on the eIDAS rules and on ISA2 (earlier IDABC and ISA) work on the European Interoperability Framework. 2 Categories of personal data 39. The EDPB and the EDPS note that Annex I sets out the categories and data fields of personal data to be processed within the Digital Green Certificate framework. In this regard, we consider that the justification of the need for such specific data fields is not clearly defined in the Prop osal. Moreover, the EDPB and the EDPS consider that further explanation should be provided as to whether all categories of personal data provided for in Annex I need to also be included in the Quick Response (“QR”) code of both digital - and paper - based cer tificates.

An approach supporting differently comprehensive data sets and QR codes can improve data minimisation in different use cases. Moreover, in relation to the effectiveness of the Digital Green Certificate, we note that the ‘expiry date’ of the vali dity of each ‘certificate’ is not specified (except for the ‘certificate of recovery’). This last aspect is linked, under the data protection viewpoint, to the lack of specification of the data retention periods. 40. In the light of these considerations and mo re specifically with regards to the vaccination certificate, the EDPB and the EDPS consider that the Proposal in its recitals should provide additional substantiation as to the need for data fields such as the vaccine medicinal product, vaccine marketing a uthorisation holder or manufacturer and number in a series of vaccinations/doses to be included in the certificate for the purpose of facilitating the exercise of the right to free movement within the EU during the COVID - 19 pandemic.

In addition, we note t hat the lack of harmonisation in the Proposal might hinder the objective of facilitating the exercise of the right to free movement of EU citizens. 41. Additionally, the EDPB and the EDPS note that, in line with Articles 5(2), 6(2), 7(1), 7(2) of the Proposal, the Commission is empowered to adopt delegated acts by adding, modifying or removing data fields on the categories of personal data of the three types of certificates. Any modification of data fields might invalidate the impact assessment, thus requiring a re - evaluation of the risk. In this regard, the EDPB and the EDPS consider that only more detailed data fields (sub - categories of data) falling under the already defined categories of data should be added through the adoption of delegated acts. The EDPS (and the EDPB when applicable) should be consulted when such delegated acts are proposed. 42. Lastly, as already mentioned in the context of purpose limitation of the Proposal, the EDPB and the EDPS also note that point 3( c) of the Annex includes as a data field of the certificate, the “disease or agent the citizen has recovered from".

In this regard, the EDPB and the EDPS consider that, given the scope of the draft Proposal and the COVID - 19 context we currently face, the d isease or agent to which the citizen has recovered from should only be limited to COVID - 19, including its variants . 3 Adoption of adequate technical and organisational privacy and security measures in the context of the Proposal 43. The EDPB and the EDPS note t hat, despite the sensitive nature of the personal data that will be included in the Digital Green Certificate, the Proposal submits to an Implementing Act by the Commission (Article 8 of the Proposal) the decision on the privacy and security measures and r equirements that the Digital Green Certificate should comply with. 44. The EDPB and the EDPS consider that the Proposal should state that the controllers and processors shall take adequate technical and organisational measures to ensure a level of security app ropriate Adopted 13 to the risk of the processing, in line with Article 32 GDPR.

These measures should consider for example the establishment of processes for a regular testing, assessment and evaluation of the effectiveness of the privacy and security measures adopt ed. Indeed, we note that these measures are designed to integrate the necessary safeguards into the processing in order to protect the rights of data subjects. Further specification of the mandatory measures might be made by means of implementing acts adop ted by the Commission in line with Article 8 of the Proposal. 45. The EDPB and the EDPS recall that the adoption of adequate technical and organisational privacy and security measures, as mentioned above, should be taken both at the time of the determination o f the means for processing as well as at the time of the processing itself, in line with the principles of data protection by design and by default as set by Article 25 GDPR. 46. Concerning the adoption by the Commission of implementing acts providing for addi tional technical specifications of the proposed types of certificates, the EDPB and the EDPS recall the obligation of the Commission to consult the EDPS and the EDPB (where applicable), in line with Article 42 EUDPR.

47. Finally, for the sake of consistency wi th the GDPR wording and due to the relevance of the adoption of adequate technical and organisational measures in the context of the Proposal, the EDPB and the EDPS also suggest adding to the title of Article 8 the wording “and Technical and organisational measures”. 4 Identification of controllers and processors 48. The EDPB and the EDPS welcome that the Proposal provides some starting point as to the clarification of the roles of controller and processor within the context of the Digital Green Certificate fra mework. In this regard, we note that, pursuant to Article 9(4) of the Proposal, the authorities responsible for issuing the Digital Green Certificate referred to in Article 3 shall be considered as controllers in the sense of Article 4(7) of the GDPR. More over, Article 8(g) of the Proposal provides that the Commission shall adopt implementing acts containing the technical specifications and rules to allocate responsibilities amongst controllers and as regards processors .

49. g. when travelling through various Member States), t he EDPB and the EDPS recommend tha t the Proposal specifies that a list of all the entities foreseen to be acting as controllers, processors and recipients of the data in that Member State (other than the authorities responsible for issuing the certificates which listed in Article 9(4) of t he Proposal) shall be made public . This will allow the EU citizens making use of the Digital Green Certificate to know the identity of the entity to whom they may turn to for the exercise of their data protection rights under the GDPR, including in particu lar the right to receive transparent information on the ways in which data subject’s rights may be exercised with respect to the processing of personal data. 50. Lastly, the EDBP and the EDPS recommend clarifying in the Proposal the role of the Commission with in the meaning of data protection law in the context of the trust framework guaranteeing interoperability between the certificates .

5 Transparency and data subject’s rights 51. The EDPB and the EDPS welcome Article 3(2) of the Proposal, which clarifies that “[t] he information contained in the certificates shall also be shown in human - readable form ”. Due to the sensitivity of the Adopted 14 data involved, the EDPB and the EDPS recommend the Commission to ensure that the transparency of the processes are clearly outlined for the citizens to be able to exercise their data protection rights. 52. ” , as this is in line with Article 5(1)(d) and 16 GDPR. 6 Data storage 53. ” and Article 9(3) of the Proposal explicitly stating that “ [t]he personal data processed for the purpose of issuing the certificates referred to in Article 3, including the issuance of a new certificate, shall not be retained longer than is necessary for its purpose a nd in no case longer than the period for which the certificates may be used to exercise the right to free movement ”, as these are both in line with the principle of data storage limitation of the GDPR.

54. The EDPB and the EDPS recall that the data storage of personal data by issuing authorities should respect the principles established in Article 5(1)(e) GDPR and, where possible, specific data storage periods should be explicitly defined. If this was not possible, then at least specific criteria used to determ ine such storage period should be specified. The EDPB and the EDPS consider that, in any case, the storage period in Member States should not go beyond the end of the COVID - 19 pandemic, in line with Article 15(2) of the Proposal. 7 International Data Transfe rs 55. )”. ” Based on this wording, the EDPB and the EDPS understand that the Proposal would be opening the door to potential international transfers of personal data in certain situations when implementing the Digital Green Certificate. The EDPB and the EDPS consider that these international transfers c ould imply an additional risk for the processing of personal data, as third countries could give a secondary use to the data exchanged within the Digital Green Certificate framework.

Therefore, the EDPB and the EDPS recommend to explicitly clarify whether and when any international transfers of personal data are expected and include safeguards in the legislation to ensure that third countries will only process the personal data exchanged for the purposes specified by the Proposal. Brussels, 31 March 2021 For the European Data Protection Board For the European Data Protection Supervisor The Chair The European Data Protection Supervisor (Andrea Jelinek) ( Wojciech Wiewiórowski)