Business travellers should not be forced to use digital health passports
Companies should avoid requiring or even asking employees to adopt digital travel health passports until they have conducted extensive data-privacy impact assessments, according to travel management company CWT
Health data is treated under the European Union's General Data Protection Regulation as ‘sensitive data’, which may be processed only if a clear legal basis has been established to do so. Such a legal basis has yet to be clarified for travel health passports. Companies also will need to carry out due diligence on the security of the different passport products under development and establish whether they, as employers, would face liability in the event of any breaches.
One travel manager who already has investigated health passports told Business Travel News his company is very wary of introducing them. “Our head of privacy reconfirmed that we must find a way this is never mandated, as the company might be liable for data breaches,” he said. “If employees adopt a passport voluntarily, because it makes their life easier, that's okay.”
A digital record of vaccines and Covid tests
Health passports carry a digital record of whether holders have been tested or vaccinated for Covid-19. A considerable number of countries worldwide currently require evidence of a negative Covid test before gaining admission, and discussion has started about whether a vaccination certificate should be made a prerequisite for border entry or boarding aircraft. At least 10 passport schemes actively are being promoted, and in some cases are already being trialled.
“Every new proposal to help people get out of their homes we'll welcome and we'll look at in compliance with privacy, but it needs to be done in compliance with fundamental privacy rights to ensure trust,” Cao-Delebarre, Global Head of CWT said. “There's more work to do right now before the passports can be issued.
“In terms of corporate communication, employers can actively promote their position towards vaccination campaigns, and engage staff in a constructive discussion. However, asking or insisting that employees sign up to health passports would carry legal risk.”
Don’t rush into it before assessing privacy impact
Addressing travel managers and the companies they work for, Cao-Delebarre said: “Don't rush into it before making sure you have carried out an in-depth privacy impact assessment. What are the consequences if you have mandated health passes as an organisation? What are you really saying to your employees? It has bigger implications in terms of potential discrimination or categorising your employees. I would really encourage them not to rush into this until there is much more certainty from governments and policymakers, and make sure that privacy and local employment law matters are checked and rechecked.”