Seòmar agus comataidhean

COVID Vaccine Passports

Minister for Parliamentary Business to the Convener, 30 September 2021

Dear Stuart,

Thank you for your letter of 28 September 2021 asking for further clarification on the data protection legislation relating to the Covid Certification Scheme.

I can confirm that the SSI was laid on Thursday 30 September 2021 and, in line with the usual arrangements for made affirmative Covid SSIs, officials shared draft regulations and policy note with committee clerks on 29 September 2021.

I can provide the following information regarding your question about data security, specifically how we will ensure against the potential misuse of the person’s information in the initial stages of domestic certification, during which a person’s name, date of birth, and vaccination data which will be visible prior to the app update in October.

In the NHS Scotland Covid Status app, the person’s data will be encrypted and stored on their phone only. No other person will have access to their data stored on their phone unless the individual decides to show their COVID Status to them. Venues or event staff are permitted to visually inspect a person’s app or paper-based form, or to scan the QR Code for the purposes of deciding whether a person can gain access to a venue or event. The scheme places a legal obligation on persons responsible for a venue or event and their staff to treat information that can be used to determine the vaccination or medical status of a person, or whether a person is participating or has participated in the trial of a vaccine trial as confidential. If a person suspects that venue or event staff have taken unauthorised screenshots of their or other people’s information then they can report this to the authorities for further investigation.

The QR code has built-in anti-fraud measures. The content of the QR code is not able to be edited and so, even if someone edited a letter or screenshot, this will be identified quickly and easily by checking the name and details within the QR code.

I trust this will satisfy you that the risk of data fraud is limited. Furthermore, I hope you will appreciate these measures are necessary, and a proportionate means to reduce the public health risk while maximising our ability to keep places open.

Yours sincerely,

George Adam