fundamental rights and non-discrimination notably on the basis of the possession of a specific category of a medical certificate 7 . In addition, the EDPB and the EDPS are of the view that the report should also address other technical issues such as the security of personal data related to the use of the certificates that have arisen when applying the Regulation in practice. 20.
As mentioned above, the EDPB and the EDPS, in this regard, stress the need to continuously evaluate which measures remain effective, necessary and proportionate as regards the purpose of the fight against the COVID-19 pandemic. Moreover, the EDPB and the EDPS recall the legal imperative for the data protection principles under Article 5 GDPR to be continuously applied and integrated in any personal data processing operation.
3.2.2 Modifications to current data fields 21.
The First Proposal contains an explicit clarification that vaccination certificates are to contain the number of doses administered to the holder, regardless of the Member State in which each dose has been administered, to accurately reflect the overall number of doses administered.
22.
To this end, the First Proposal seeks to amend paragraph 2, point (b) of Article 5 of the Regulation as follows [proposed changes highlighted]: “information about the COVID-19 vaccine and the number of doses administered to the holder, regardless of the Member State in which they have been administered”.
23.
In the specific case described above, the EDPB and the EDPS understand that the proposed change seeks to address situations where individuals have received vaccination doses in different Member States. Therefore, the proposed change seems to be limited to what is strictly necessary and does not raise particular concerns from a data protection perspective.
24.
This would however be different should the Commission seek to substantially modify the current data fields. In this context, the EDPB and the EDPS recall their previous position that any modification of data fields might require a re-evaluation of the risks to fundamental rights and that only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be added through the adoption of delegated acts 8 .
25.
Additionally, the EDPB and the EDPS note that the First Proposal provides that persons participating in clinical trials for the development of COVID-19 vaccines are also eligible to receive a COVID-19 vaccination certificate (EUDCC). For the sake of legal certainty, the EDPB and the EDPS consider that the First Proposal should clarify whether the information that a data subject has participated in a clinical trial would or would not be added to the categories of data listed in Article 5(2) of the Regulation. Should such category of data be added, the EDPB and the EDPS refer to the recommendations put forward in paragraph 41 of the EDPB-EDPS Joint Opinion 04/2021 and recalled in paragraph 23 of the current Opinion.
26.
The EDPB and the EDPS further recall paragraph 39 of the Joint Opinion, in which the EDPB and the EDPS note that "(...) an approach supporting differently comprehensive data sets and QR codes can improve data minimisation in different use cases." Should the Digital COVID Certificate recording the three doses, or any further possible doses, be used for purposes other than freedom of movement,
7 8
See Article 3(7) of the Regulation. EDPB-EDPS Joint Opinion 04/2021, para. 41.
Adopted
7
