NHS App gets go-ahead for vaccine passport use despite protest from privacy groups

Folks in England can from next week use the NHS App to confer their vaccination status, in the face of warnings that the technology could lead to identifiable medical information being exposed. The British government has announced that from 17 May, people will be able to demonstrate their COVID-19 vaccination status – a so- …

[Woodnag]

It's a tracking ID card by stealth: a phone app, not a PC program

Per the first link: "You may still be required to show other proof like a negative polymerase chain reaction (PCR) test, and you may still have to isolate on arrival."

SO it doesn't even do what it says on the packet.

Can ask for a paper copy too.

[Anonymous Coward]

It's worth stressing this is different from the COVID Tracing app abortively launched last year that knows about everyone you meet. This is the NHS app that already knows your identity, because you can use it for ordering repeat prescriptions and booking (some) appointments.

Domestically the point is going to be moot. By the time this rolls out enough of the population will have been vaccinated to make any form of domestic vaccination certification pointless. It'd be like asking for measles certification. However the reality is many/most countries are going to require some form of verifiable record-of-test or record-of-vaccination, the same as they do today for any number of infectious diseases. Vaccine passporting at the border is going to be unavoidable, just like, er, actual passporting.

There are worse ways to meet that requirement than extending a pre-existing app plenty of people already use.

[Jellied Eel]

Domestically the point is going to be moot. By the time this rolls out enough of the population will have been vaccinated to make any form of domestic vaccination certification pointless. It'd be like asking for measles certification.

Sounds like a plan. It's extensible to all sorts of certifications from vaccinations to drivers licences and much much more. Basically back to the selling point Labour tried with their ID Cards plans, and using 'creeping compulsion' to encourage acceptance. Suddenly you'll 'need' the app to do many of the things you used to be able to do without it.

And once people are conditioned to 'needing' an app for that, it'll be easier to add other features that people didn't know they needed to exist.. All of which will generate all sorts of previously private data that will be valuable to analytics firms.

It's also somewhat pointless given the risk is mostly to the un-vaccinated, and may be a false sense of security if mutations mean vaccinations are no longer effective.. Especially given there are already limits to the effectiveness. So a vaccine may be 95% effective, but that means it would be ineffective for say 3-5m people in the UK, assuming 100% vaccinated.

But such is politics. Governments rarely like giving up control, and we've just had Boris giving us permission to hug. And the BBC giving a handy guide to how to hug in a post-Covid world. Not sure if this still means we're supposed to mask up for sex, of if suggestions that masks will become a permanent fixture are a good idea.

But hey ho, there was good news over winter in that Covid prevention measures managed to eliminate deaths from flu! Or not, but such is coding..

[Anonymous Coward]

>and using 'creeping compulsion' to encourage acceptance

You've misread this entirely. I'm saying these won't be used domestically. At all. If enough of the population are vaccinated you don't need to check individual vaccine status. That is the whole point of vaccinating everyone that we can. Why would businesses and employers go to the effort of checking if they don't need to? Where's the gain?

We've not seen any indication at all that anyone intends to use certificates domestically, or that the government will encourage such use. They'll take it as a triumph that they don't need to - it'll save a fortune and allow businesses to open up faster.

The exception to this is at the border, where many countries require certification of vaccination against a range of infectious diseases to enter. This includes diseases like yellow fever and TB.

If I can produce that certification for COVID digitally from my phone instead of from a tatty, dog-eared yellow pamphlet as in the days of old then... good! If you object to this data existing in the app then you simply object to the data existing within the NHS at all - all it does is reflect your patient record.

[Jellied Eel]

That is the whole point of vaccinating everyone that we can. Why would businesses and employers go to the effort of checking if they don't need to? Where's the gain?

Insurance premiums and avoiding liability. At the moment, what will happen is anybody's guess. But there's been speculation that could be 'needing' proof of vaccination to go to work, pubs & clubs, concerts, sports events etc etc.

If I can produce that certification for COVID digitally from my phone instead of from a tatty, dog-eared yellow pamphlet as in the days of old then... good!

But I could produce official certification from a credit card sized bit of cardboard with some handwritten notes on it. I have one of those. I could have many unofficial ones if I could be bothered to print some. Blanks have been stolen from surgeries, or people seem happy to post theirs up on facepalm etc so they could be copied.

The app will of course be much more secure because it's digital. Until it isn't. But such is politics.

[Anonymous Coward]

>Insurance premiums and avoiding liability.

Don't be so absurd. Insurers couldn't give a monkeys whether or not your patrons are carrying a covid certificate. Why would they? It's not something they will ever be on the hook for.

>But I could produce official certification from a credit card sized bit of cardboard with some handwritten notes on it.

You still can. You can call up 119 and get one posted out to you. You could even commit a spot of light fraud and fabricate one yourself if you were that way inclined - nobody would bat an eyelid domestically because nobody is going to end up checking these things. You seem to just hate the idea of the same information that the NHS already hold about you being accessible in a digital format.

[Woodnag]

Insurance?

I remember forms for all sorts of risk based products, like insurance, asking if the form-filler has had an HIV test. This is some 30 years ago. The thinking was that people who had taken such a test self-identified with a high risk lifestyle.

I don't see the benefit of taking a CV test unless there's a immediate need for a negative result (travel etc), because a false positive could bite you later.

[Anonymous Coward]

Re: Insurance?

Has anyone asked you to take a Covid test without an immediate need? No! If you live as a hermit, do your shopping online and don't hug the postman we really don't care. If you send your kids to school, stand next to me in a supermarket queue, want to visit granny in her house, then not doing a Rapid Flow test because of some paranoia that a small chance of a false positive might find its way into a database and you get denied insurance seems like action of a sociopath, not a rational human.

[Jellied Eel]

Re: Insurance?

...then not doing a Rapid Flow test because of some paranoia that a small chance of a false positive might find its way into a database and you get denied insurance seems like action of a sociopath, not a rational human.

Funny you should mention those. My local pharmacy was distributing those, so I picked up a 7-pack. I figured it was better to have them and not need them etc. Like if i felt symptomatic, advice is to self-isolate, so bimbling down to the pharmacy then would be a bit anti-social. Ok, so I could also order online, but no idea what the lead times would be on those.

So I could find out if my tonsils or nostrils were pregnant with millions of viral particles. The instructions told me I should register my results, but what if I didn't? Most people are probably responsible, but some may be reluctant to register a positive (or negative) result.. Those pesky databases again.

(I'm a bit curious what the point is. I'm not sure if they detect viral RNA or antibodies. It could mean a positive result due to vaccination, or a positive result due to the presence of virus, even though you may have been vaccinate. In which case the virus shouldn't replicate, and there's no real need to isolate. But there's also the case that it may mean the vaccination hasn't worked, so then your vaccination status would be it's own false positive.. But at least correlating post-vaccination positives could give some idea about true vaccine effectiveness.)

[Jellied Eel]

Don't be so absurd. Insurers couldn't give a monkeys whether or not your patrons are carrying a covid certificate. Why would they? It's not something they will ever be on the hook for.

Sure. So they could deny cover unless policies were in place to minimise risk. It may be a suprise to you but employers or businesses have a duty of care towards their employees and/or patrons. There's also legislation about social distancing. So if your staff work in reasonably Dilbert-sized cubicle farms, you might be ok. If they're packed in tighter than battery hens at a call centre, you might not. Someone gets sick or dies, then medical insurance or liability insurance might not apply because you failed to take 'reasonable precautions'..

Hence why there have been a few stories about employers requiring vaccinations, even though that opens up other cans of worms. Like liability if there's a problem with vaccines, eg developing blood clots after sitting for X 12-hr shifts. Or how policies would comply with medical discrimination or 'right to work' legislation.

You seem to just hate the idea of the same information that the NHS already hold about you being accessible in a digital format.

You seem to have a poor understanding of information security, privacy or just data protection principles. Again this was much like the ID Cards omnishambles-

https://en.wikipedia.org/wiki/Identity_Cards_Act_2006#Database_extent_and_access

Home Office forecasts envisaged that "265 government departments and as many as 48,000 accredited private sector organisations" would have had access to the database, and that 163 million identity verifications or more would take place each year.

Again this was a risk of both 'creeping compulsion' or just scope creep given there was a pretty much unlimited potential for the types of data that could be added to the Register (not this one!). Databases, bless them. Reality is/was very little of the proposed 50+ bits of personal information were really needed to prove identity, and where necessary, alternatives already existed. By bloating the requirements, the costs and risks were exponentially increased.

So back to today. If the requirement is for me to prove vaccination status, I can do that with my scrap of cardboard. I don't need an app for that. I certainly don't need an app that's running on a couple of notorious ad-funded platforms that perform extensive data collection, aggregation and wholesaling. Sure, it's simple to fake the current vaccination card. But it can also be simple to fake electronic alternatives, and once there's a class break, it's very hard to regain trust in the data.

[Anonymous Coward]

This is just total nonsense. Absolutely uninformed waffle. Employers would only be liable for covid infections at work if they are found to be negligent with respect to their duty of care, and that that negligence caused or materially contributed to the resulting infection. The duty of care does not translate to a requirement to transform into a jackbooted thug of the surveillance state.

From an insurer's perspective, and from a duty of care perspective, if the community incidence of the virus is low enough and community vaccine uptake high enough then there is no need to routinely test anyone or verify the status of anyone. There's no point. It - verifiably - would not make anyone any safer, and it would cost a shedload of money, so nobody is going to be doing it as a matter of routine.

[Jellied Eel]

This is just total nonsense. Absolutely uninformed waffle. Employers would only be liable for covid infections at work if they are found to be negligent with respect to their duty of care,

Here's a little something from my favorite law firm-

https://www.pinsentmasons.com/out-law/guides/coronavirus-can-uk-employers-require-staff-vaccinated

...Are there health and safety issues around mandating vaccination?

Under UK health and safety law, employers also have obligations to reduce health risks to employees and others to a level which is as low as reasonably practicable. The vaccine should be considered as part of Covid-19 risk assessments, as a potential additional measure to control the risks associated with contracting the virus at work.

I'm guessing you're not an employer, but the article is worth a read..

The duty of care does not translate to a requirement to transform into a jackbooted thug of the surveillance state.

There'll be an app for that. Jackboots optional, masks mandatory. Ensure you follow the correct hugging procedure, or permission to hug may be revoked..

There's no point. It - verifiably - would not make anyone any safer, and it would cost a shedload of money, so nobody is going to be doing it as a matter of routine.

Ah, well, you're right, and you're wrong-

https://www.gov.uk/government/collections/guidance-for-schools-coronavirus-covid-19

What school leaders, teachers and school staff need to do during the coronavirus (COVID-19) outbreak

...Rapid asymptomatic testing was introduced on site in secondary schools and colleges on 4 January. As pupils and students returned to secondary schools and colleges from 8 March all eligible staff, pupils and students were expected to test twice weekly.

Which is a bit confusing, ie if it's guidance, it probably should 'need' schools to do something. Also if the twice weekly expectation is ongoing, or was just for the back to school period. But as you say, it's fairly pointless anyway.

[John Brown (no body)]

"But there's been speculation that could be 'needing' proof of vaccination to go to work, pubs & clubs, concerts, sports events etc etc."

The operative word there being "speculation" of course. The news media need to fill their 24/7 output with something, and in the absence of fact, will take speculation any day of the week.

[gnasher729]

"It's worth stressing this is different from the COVID Tracing app abortively launched last year that knows about everyone you meet"

What the hell? Did you read _anything_ about how this works? COVID tracing doesn't know _anything_ about anyone you meet. It knows you were near a phone that used a random ID which changes every 15 minutes. It's impossible to find out which phone that was.

[Mike 137]

A fetid dingo's kidneys

It really doesn't matter even that much what anyone thinks or objects to about it - it'll be steamrollered over us by HM Gov regardless if they "consider" it's a bright idea. Unintended consequences might possibly be considered after the fact if they could affect elections, but don't hold your breath.

[Flocke Kroes]

Cannot affect elections

When it comes to MPs security all parties are united on the absolute need to spy on voters in every way possible.

[Fruit and Nutcase]

Re: Cannot affect elections

I think in theory, it is possible to trace a given voting slip to an individual. They record your voter register number against the number on the slip when they hand it out.

[Anonymous Coward]

Re: Cannot affect elections

There's nothing theoretical about it. Your vote is designed to be traceable in extremis. That's one of the reasons we know how much identity fraud is going on with voting today - the answer being absolutely none whatsoever in any material sense. Which is why voter ID rules should be called what they are - voter suppression.

[Fruit and Nutcase]

Re: Cannot affect elections

Not just voter suppression - after the recent Mayoral elections, looks like they want to change the voting system for the Mayoral elections from first preference to first past the post to make it easier to elect conservative candidates.

Boris' lying is "factored in" by the conservative party, just like Trump and the Republican party

[Nifty]

Re: Cannot affect elections

Next up they'll be wanting photo id to prove that your pre-signed postal vote wasn't purchased as part of a job lot.

[Fruit and Nutcase]

Paper version

"A paper version will also be available - by calling 119 but not through a GP.

Both will be available from Monday, 17 May, when the ban on foreign travel is eased."

https://www.bbc.co.uk/news/technology-57070185

[Conyn Curmudgeon]

I already have the Patient Access app on my Phone (made ages ago in conjunction with the NHS) for all of my repeat prescription meds and appointment bookings and it already shows both of my Vauxhall Astra COVID-19 jabs, dose and date. Why on earth would the government want to push out another one much the same? Sinister, with Priti "Hitler & Thatcher spawn" Patel in the home office I wouldn't trust anything they want to push out.

[Pascal Monett]

Ooh, equating Thatcher with Hitler.

That's a new one.

[Anonymous Coward]

Priti "Hitler & Thatcher spawn" Patel

[Pedantic switch on] Clearly, that's combining the potency of the two, rather than equating.

[Intractable Potsherd]

No, Pascal - the OP is clearly saying that Hitler and Thatcher were different people with different major failings as human beings, causing different atrocities on ordinary people. If such failings were genetically transmissible, the result of such a mating would be horrific for everyone concerned.

HTH

[Someone Else]

Ante-up, Britain!

So now Great Britland has effectively mandated that the entire populace must have a multi-hundred pound (Sterling) device in order to prove you're "safe". One that you, citizen, are on the hook to purchase and maintain.

Nice work, Boris! Aldous would have never envisioned the day where the Proles would have to pay for their own telescreens.

[Anonymous Coward]

Re: Ante-up, Britain!

There is a freely available paper version available 5 days after your second jab that you can get by calling 119.

[Anonymous Coward]

Re: Ante-up, Britain!

@Someone Else

Just a thought for you. Why. don't you just not download the app

[Anonymous Coward]

I've had a vaccine passport for decades

Some countries won't let you in without a yellow fever vaccination certificate.

[Graham Cobb]

Re: I've had a vaccine passport for decades

Yes, and it does its job very well. Despite just being a bit of yellow folded paper. No photos, no significant anti-forgery features, no centralised control over issuing (high street pharmacies have stacks of them for issuing when they give the vaccination), etc.

We do not need to sacrifice privacy when proving we have received the vaccination. For international purposes they will need a name on them (like the yellow fever card), to be matched against a (separate) passport, for domestic use the current cardboard card should be perfectly acceptable, with no identity information at all. If I am going to a play or to a sports match I have no need to identify myself.

[ibmalone]

No need to worry

Friends who've attempted to use this app in the past find it doesn't recognise their details anyway. Can't leak personal data if you can't access it! Clever.

[quxinot]

Re: No need to worry

That raises an important question.

I'm absolutely certain that this will be found to leak data at some point; only the timeframe is in question.

But given the sheer quantity of data leaks we have today, I really wonder how many of them are full of horribly wrong data. I never actually considered that the 'oh noes, a million emails were hacked' vs 'it's the email of a bot/throwaway account' ratio, for example.

[Anonymous Coward]

Meanwhile, back in La France...

I (and my wife) had our AZ 1st dose in a 'Centre de Vaccination' in good 'ole Guéret (that's Creuse, France if you are curious)

With many 'pompiers' doing the biz, we had to supply our no de sécurite sociale as part of pre-immunisation (FFS it's not a 'jab' - it's an IMMUNISATION)

[pedant: vaccination is against 'vaccinia' i.e. smallpox] .

On leaving we received an A4 sheet detailing our name, address; social security (aka NHS no.): immunisation date; type; batch no; who administered (and authority to) and an exhortation to bring to next injection...

As we could see all the info recorded, I'm not worried and quite happy to carry and show it to whomsoever wants to know.

Info not showing on my Améli.fr account yet though..

[Anonymous Coward]

Re: Meanwhile, back in La France...

The pedant in you might be pleased to learn your pedantry is incorrect. The term "vaccinia" as a formal name for the smallpox virus came after vaccination. Cowpox has the latin name variolae vaccinus. This translates pretty much directly as pox of the cow. The terms vaccine and vaccination originated in the use of cow-derived material for the first of Jenner's innoculations. The term vaccinia was coined much later when the understanding was gained that the cowpox and smallpox viruses were not the same.

By any definition modern or classical the jabs that we receive are both vaccines and immunisations. They are also likely to be widely accepted as innoculations, but they are certainly not variolations.

[AlanSh]

It's here now

I've loaded the NHS app as I was already registered for patient access. My medical record already shows the two jabs I have had with dates and the vaccine type.

I have no hesitation in showing this on my phone to who ever wants it. I can't see that it erodes my privacy any further than it already is.

Alan

[Pascal Monett]

Re: I can't see that it erodes my privacy any further

I'm sure you'll find out soon enough.

[Anonymous Coward]

It's here now but ...

Well yes, it's here now and I can see my jabs via my GP's website. So if some immigration official wants to come to my house with a warrant or two, I'll be happy to show it to them. But I don't have any mobile computing devices designed/permitted to show such a web page as a matter of choice. So I'm not sure what use the digital version will be. I'll stick with the handily forgeable paper version, thanks.

[JohnMurray]

Re: It's here now but ...

........but USA Homeland Security may want you to unlock your phone for them....or even UK police !

[John Brown (no body)]

Re: It's here now but ...

Yeah, but UK Police need "reasonable suspicion" while US Homeland Security just need you to be within 100 miles of a "port of entry". :-)

[Anonymous Coward]

Re: It's here now but ...

Not sure what your point is here? You don't own a modern mobile. Do you want a prize, maybe a big shiny medal or a rosette you can wear out so everyone knows?

[Anonymous Coward]

Re: It's here now but ...

And there's a browser version of the NHS App

https://www.nhsapp.service.nhs.uk/

[Anonymous Coward]

China-bug

Pure BS to justify the millions spent on the app that didn't work properly, if you can still get the China-bug and give after the vaccination it makes no difference, not having a vaccination is a personal choice and only puts that one person at (alleged) risk. Vaccine passports are just not needed !

[John Robson]

Re: China-bug

"if you can still get the China-bug and give after the vaccination it makes no difference, not having a vaccination is a personal choice and only puts that one person at (alleged) risk."

So everyone should be allowed to drive through town at 100mph and ignore traffic lights, because there's still a chance you could crash even if you do obey the rules of the road, so there is no benefit.

Get your head out of your backside, remove the tin foil, and do something useful for society - get vaccinated.

[Anonymous Coward]

Re: China-bug

With the vaccine you can still get the virus, but your body has a head-start on fighting it which means that the virus doesn't get a chance to establish itself. That means that you don't suffer anywhere near as much and are less contagious.

Having the majority of the population in that state will decimate the spread of the virus rather quickly, which then reduces your chance of contracting it at all.

That is certainly not "no difference" and being contagious means you put more than just yourself at risk.

Generally, el Reg readers are of higher-than-average intelligence, but there's always an exception.

[gnasher729]

Re: China-bug

"With the vaccine you can still get the virus, but your body has a head-start on fighting it which means that the virus doesn't get a chance to establish itself."

That is correct. However, the first effect is that a large number of vaccinated people won't get Covid at all in a situation where someone who isn't vaccinated would. So if 100 people with / without vaccine come too close to someone with Covid, 10 people instead of 100 catch it, and those 10 will have on average less bad effects than the 100 and will on average spread the virus less than the 100, on top of the 90 that don't get Covid at all, have no health effects and don't spread anything

[John Brown (no body)]

Re: China-bug

"Pure BS to justify the millions spent on the app that didn't work properly,"

Which article did you read? The one you are commenting on makes it clear that the NHS app not only is NOT the Track & Trace app but is the standard patient access app released way back in 2019.

I think you need to go back to your anti-vaxxor facebook group and stop trying to play with the grown-ups.

[Anonymous Coward]

confirm vaccine status prior to international travel

it's just a little unfortunate that there's nothing from our 'dear international partners' in the EU to _seriously_ indicate such QR would be accepted as proof of vaccination (other than by a handful of countries desperate for overdue British blabber. But hey, after you spent your 14 days' holiday in the peace and quiet of foreign quarantine hotel, you won't have to waddle through the similar expense when you manage to return to the sunny and breezy shores of Great! Britain!

[Anonymous Coward]

Re: confirm vaccine status prior to international travel

Have you actually read that on an EU website or are you making it up? As there currently aren't any EU countries on the green list, apart from Portugal, and as Portugal isn't accepting tourists you wouldn't really accept them to specify the form of certification they would accept.

What the EU have actually proposed is:

This should be facilitated once the Digital Green Certificate becomes operational, in line with the rules the Commission proposed on 17 March. In particular, travellers should be able to prove their vaccination status with a Digital Green Certificate issued by Member States' authorities on an individual basis, or with another certificate recognised as equivalent by virtue of a Commission adequacy decision.

Until the Digital Green Certificate is operational, Member States should be able to accept certificates from non-EU countries based on national law, taking into account the ability to verify the authenticity, validity and integrity of the certificate and whether it contains all relevant data.

Member States could consider setting up a portal allowing travellers to ask for the recognition of a vaccination certificate issued by a non-EU country as reliable proof of vaccination and/or for the issuance of a Digital Green Certificate.

[Anonymous Coward]

Re: confirm vaccine status prior to international travel

so which countries on the green list have agreed to accept our QR vaccination proof as of next Monday?

[Anonymous Coward]

Re: confirm vaccine status prior to international travel

Iceland has said it will accept UK paper certificates, and any official app that the UK government approves.

[TechHeadToo]

Just use a loaner phone.

has Boris even considered that a phone is not surgically attached?

Just cosy up to someone with a good record and use his/her phone.....

or does the NHS application know whose hand it is in. I refuse to use it. I did download it, I looked at what it offered, considered the likelihood of it being hacked, considered the capability of the people coding it (World leading Track n Trace, remember)

and I deleted it.

Roughly speaking, anywhere that won't let me in I don't want to give my money to, and this is all about the moeny. to the venue, and to Boris's chums who wrote it quick and cheap for only a couple billion.

If you call me a sceptic, you'd be telling the truth.