3.2.2 Modifications to current data fields

fundamental rights and non-discrimination notably on the basis of the possession of a specific category of a medical certificate7 . In addition, the EDPB and the EDPS are of the view that the report should also address other technical issues such as the security of personal data related to the use of the certificates that have arisen when applying the Regulation in practice.

20. As mentioned above, the EDPB and the EDPS, in this regard, stress the need to continuously evaluate

which measures remain effective, necessary and proportionate as regards the purpose of the fight

against the COVID-19 pandemic. Moreover, the EDPB and the EDPS recall the legal imperative for

the data protection principles under Article 5 GDPR to be continuously applied and integrated in

any personal data processing operation.

3.2.2 Modifications to current data fields

21. The First Proposal contains an explicit clarification that vaccination certificates are to contain the number of doses administered to the holder, regardless of the Member State in which each dose has been administered, to accurately reflect the overall number of doses administered.

22. To this end, the First Proposal seeks to amend paragraph 2, point (b) of Article 5 of the Regulation as follows [proposed changes highlighted]: “information about the COVID-19 vaccine and the number of doses administered to the holder, regardless of the Member State in which they have been administered”.

23. In the specific case described above, the EDPB and the EDPS understand that the proposed change seeks to address situations where individuals have received vaccination doses in different Member States. Therefore, the proposed change seems to be limited to what is strictly necessary and does not raise particular concerns from a data protection perspective.

24. This would however be different should the Commission seek to substantially modify the current data fields. In this context, the EDPB and the EDPS recall their previous position that any modification of

data fields might require a re-evaluation of the risks to fundamental rights and that only more

detailed data fields (sub-categories of data) falling under the already defined categories of data should be added through the adoption of delegated acts 8 .

25. Additionally, the EDPB and the EDPS note that the First Proposal provides that persons participating in clinical trials for the development of COVID-19 vaccines are also eligible to receive a COVID-19 vaccination certificate (EUDCC). For the sake of legal certainty, the EDPB and the EDPS consider that

the First Proposal should clarify whether the information that a data subject has participated in a clinical trial would or would not be added to the categories of data listed in Article 5(2) of the

Regulation. Should such category of data be added, the EDPB and the EDPS refer to the recommendations put forward in paragraph 41 of the EDPB-EDPS Joint Opinion 04/2021 and recalled in paragraph 23 of the current Opinion.

26. The EDPB and the EDPS further recall paragraph 39 of the Joint Opinion, in which the EDPB and the EDPS note that "(...) an approach supporting differently comprehensive data sets and QR codes can improve data minimisation in different use cases." Should the Digital COVID Certificate recording the three doses, or any further possible doses, be used for purposes other than freedom of movement,

7 See Arti cl e 3(7) of the Regul ation. 8 EDPB-EDPS Joi nt Opinion 04/2021, para.41.

the necessary categories of personal data included in the QR code must be reassessed and different technical solutions improving data minimisation in different use cases may be needed. The EDPB and

the EDPS therefore invite the Commission to assist the Member States in developing such technical

specifications9 .

Brussels, 14 March 2022

For the European Data Protection Supervisor

The European Data Protection Supervisor

(Wojciech Wiewiorowski) For the European Data Protection Board

The Chair

(Andrea Jelinek)

9 See Formal Comments of the EDPS on the draft Commi s sion Impl ementi ng Deci s ion (EU) amending Impl ementi ng Decision (EU) 2021/1073 laying down technical specifications and rules for the i mplementation of the trus t framework for the EU Di gi tal COVID Certificate es tablished by Regul ation (EU) 2021/953 of the European Parliament and of the Council, 18 October 2021 https ://edps.europa.eu/system/files/2021-10/20210943%20Formal_comments_EUDCC_en.pdf)