This document is an excerpt from the EUR-Lex website
Document 02021R0953-20220331
Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (Text with EEA relevance)Text with EEA relevance
Consolidated text: Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (Text with EEA relevance)Text with EEA relevance
Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (Text with EEA relevance)Text with EEA relevance
02021R0953 — EN — 31.03.2022 — 003.001
This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document
REGULATION (EU) 2021/953 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (OJ L 211 15.6.2021, p. 1) |
Amended by:
|
|
Official Journal |
||
No |
page |
date |
||
COMMISSION DELEGATED REGULATION (EU) 2021/2288 of 21 December 2021 |
L 458 |
459 |
22.12.2021 |
|
COMMISSION DELEGATED REGULATION (EU) 2022/256 of 22 February 2022 |
L 42 |
4 |
23.2.2022 |
|
COMMISSION DELEGATED REGULATION (EU) 2022/503 of 29 March 2022 |
L 102 |
8 |
30.3.2022 |
Corrected by:
REGULATION (EU) 2021/953 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 14 June 2021
on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic
(Text with EEA relevance)
Article 1
Subject matter
This Regulation lays down a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) for the purpose of facilitating the holders’ exercise of their right to free movement during the COVID-19 pandemic. This Regulation shall also contribute to facilitating the gradual lifting of restrictions to free movement put in place by the Member States, in accordance with Union law, to limit the spread of SARS-CoV-2, in a coordinated manner.
It provides for the legal ground to process the personal data necessary to issue such certificates and to process the information necessary to verify and confirm the authenticity and validity of such certificates in full compliance with Regulation (EU) 2016/679.
Article 2
Definitions
For the purposes of this Regulation, the following definitions apply:
‘holder’ means a person to whom an interoperable certificate containing information about that person’s COVID-19 vaccination, test result or recovery has been issued in accordance with this Regulation;
‘EU Digital COVID Certificate’ means interoperable certificates containing information about the vaccination, test result or recovery of the holder issued in the context of the COVID-19 pandemic;
‘COVID-19 vaccine’ means an immunological medicinal product indicated for active immunisation to prevent COVID-19 caused by SARS-CoV-2;
‘NAAT test’ means a molecular nucleic acid amplification test, such as reverse transcription polymerase chain reaction (RT-PCR), loop-mediated isothermal amplification (LAMP) and transcription-mediated amplification (TMA) techniques, used to detect the presence of the SARS-CoV-2 ribonucleic acid (RNA);
‘rapid antigen test’ means a test that relies on detection of viral proteins (antigens) using a lateral flow immunoassay that gives results in less than 30 minutes;
‘antibody test’ means a laboratory-based test aiming to detect if a person has developed antibodies against SARS-CoV-2, thus indicating that the holder has been exposed to SARS-CoV-2 and has developed antibodies, regardless of whether that person was symptomatic;
‘interoperability’ means the capability of verifying systems in a Member State to use data encoded by another Member State;
‘barcode’ means a method of storing and representing data in a visual, machine-readable format;
‘electronic seal’ means electronic seal as defined in point (25) of Article 3 of Regulation (EU) No 910/2014;
‘unique certificate identifier’ means a unique identifier given, in accordance with a common structure, to each certificate issued in accordance with this Regulation;
‘trust framework’ means the rules, policies, specifications, protocols, data formats and digital infrastructure regulating and allowing for the reliable and secure issuance and verification of certificates to ensure their trustworthiness by confirming their authenticity, validity and integrity, through the use of electronic seals.
Article 3
EU Digital COVID Certificate
The EU Digital COVID Certificate framework shall allow for the issuance, cross-border verification and acceptance of any of the following certificates:
a certificate confirming that the holder has received a COVID-19 vaccine in the Member State issuing the certificate (vaccination certificate);
a certificate confirming that the holder has been subject to a NAAT test or a rapid antigen test listed in the common and updated list of COVID-19 rapid antigen tests established on the basis of the Council Recommendation of 21 January 2021 carried out by health professionals or by skilled testing personnel in the Member State issuing the certificate and indicating the type of test, the date on which it was carried out and the result of the test (test certificate);
a certificate confirming that, following a positive result of a NAAT test, or a rapid antigen test listed in the EU common list of COVID-19 antigen tests agreed by the Health Security Committee, carried out by health professionals or by skilled testing personnel, the holder has recovered from a SARS-CoV-2 infection (certificate of recovery).
The Commission shall publish the list of COVID-19 rapid antigen tests established on the basis of the Council Recommendation of 21 January 2021, including any updates.
The certificates referred to in paragraph 1 shall include the following text:
‘This certificate is not a travel document. The scientific evidence on COVID-19 vaccination, testing and recovery continues to evolve, including with regard to new virus variants of concern. Before travelling, please check the applicable public health measures and related restrictions applicable at the point of destination.’
Member States shall provide the holder with clear, comprehensive and timely information on the issuance and purpose of vaccination certificates, test certificates, or certificates of recovery for the purposes of this Regulation.
Before adopting such implementing acts, the Commission shall assess whether such a third country issues certificates equivalent to those issued in accordance with this Regulation and has provided formal assurances that it will accept certificates issued by the Member States.
The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 14(2).
Article 4
Trust framework for the EU Digital COVID Certificate
Article 5
Vaccination certificate
The vaccination certificate shall contain the following categories of personal data:
the identity of the holder;
information about the COVID-19 vaccine and the number of doses administered to the holder;
certificate metadata, such as the certificate issuer or a unique certificate identifier.
The personal data shall be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the Annex.
The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend point 1 of the Annex by modifying or removing data fields, or by adding data fields falling under the categories of personal data referred to in points (b) and (c) of the first subparagraph of this paragraph, where such an amendment is necessary to verify and confirm the authenticity, validity and integrity of the vaccination certificate, in the case of scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards.
Member States may also accept, for the same purpose, vaccination certificates issued by other Member States in accordance with this Regulation for a COVID-19 vaccine that has been granted a marketing authorisation by the competent authority of a Member State pursuant to Directive 2001/83/EC, a COVID-19 vaccine the distribution of which has been temporarily authorised pursuant to Article 5(2) of that Directive, or a COVID-19 vaccine that has completed the WHO emergency use listing procedure.
Where Member States accept vaccination certificates for a COVID-19 vaccine referred to in the second subparagraph, they shall also accept, under the same conditions, vaccination certificates issued by other Member States in accordance with this Regulation for the same COVID-19 vaccine.
Article 6
Test certificate
The test certificate shall contain the following categories of personal data:
the identity of the holder;
information about the NAAT test or rapid antigen test to which the holder was subject;
certificate metadata, such as the certificate issuer or a unique certificate identifier.
The personal data shall be included in the test certificate in accordance with the specific data fields set out in point 2 of the Annex.
The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend point 2 of the Annex by modifying or removing data fields, or by adding data fields falling under the categories of personal data referred to in points (b) and (c) of the first subparagraph of this paragraph, where such an amendment is necessary to verify and confirm the authenticity, validity and integrity of the test certificate, in the case of scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards.
Article 7
Certificate of recovery
A Member State may also issue, upon request, certificates of recovery referred to in point (c) of Article 3(1) following a positive result of a rapid antigen test listed in the EU common list of COVID-19 antigen tests agreed by the Health Security Committee carried out by health professionals or by skilled testing personnel.
Member States may issue certificates of recovery based on rapid antigen tests carried out by health professionals or by skilled testing personnel on or after 1 October 2021, provided that the rapid antigen test used was included in the EU common list of COVID-19 antigen tests agreed by the Health Security Committee at the time the positive test result was produced.
Certificates of recovery shall be issued at the earliest 11 days after the date on which a person was first subject to a NAAT test or rapid antigen test that produced a positive result.
The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend the number of days after which a certificate of recovery is to be issued, on the basis of guidance received from the Health Security Committee in accordance with Article 3(11) or on scientific evidence reviewed by ECDC.
The certificate of recovery shall contain the following categories of personal data:
the identity of the holder;
information about past SARS-CoV-2 infection of the holder following a positive test result;
certificate metadata, such as the certificate issuer or a unique certificate identifier.
The personal data shall be included in the certificate of recovery in accordance with the specific data fields set out in point 3 of the Annex.
The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend point 3 of the Annex by modifying or removing data fields, or by adding data fields falling under categories of personal data referred to in points (b) and (c) of the first subparagraph of this paragraph, where such an amendment is necessary to verify and confirm the authenticity, validity and integrity of the certificate of recovery, in the case of scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards.
Article 8
COVID-19 certificates and other documentation issued by a third country
Before adopting such an implementing act, the Commission shall assess whether COVID-19 certificates issued by the third country fulfil the conditions set out in the first subparagraph.
The implementing act referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 14(2).
The Commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available.
Article 9
Technical specifications
In order to ensure uniform conditions for the implementation of the trust framework established by this Regulation, the Commission shall adopt implementing acts containing the technical specifications and rules for the purpose of:
securely issuing and verifying the certificates referred to Article 3(1);
ensuring the security of personal data, taking into account the nature of the data;
populating the certificates referred to Article 3(1), including the coding system and any other relevant elements;
laying down the common structure of the unique certificate identifier;
issuing a valid, secure and interoperable barcode;
seeking to ensure interoperability with international standards and technological systems;
allocating responsibilities among controllers and as regards processors, in accordance with Chapter IV of Regulation (EU) 2016/679.
ensuring accessibility for persons with disabilities to the human-readable information contained in the digital certificate and in the paper-based certificate in accordance with the accessibility requirements under Union law.
Article 10
Protection of personal data
Article 11
Restrictions to free movement and information exchange
Where a Member State requires, in accordance with Union law, holders of the certificates referred to in Article 3(1) to undergo, after entry into its territory, quarantine or self-isolation or to be tested for SARS-CoV-2 infection, or if it imposes other restrictions on the holders of such certificates because, for example, the epidemiological situation in a Member State or in a region within a Member State worsens quickly, in particular as a result of a SARS-CoV-2 variant of concern or interest, it shall inform the Commission and the other Member States accordingly, if possible 48 hours in advance of the introduction of such new restrictions. To that end, the Member State shall provide the following information:
the reasons for such restrictions;
the scope of such restrictions, specifying which certificate holders are subject to or exempt from such restrictions;
the date and duration of such restrictions.
Article 12
Exercise of the delegation
Article 13
Urgency procedure
Article 14
Committee procedure
Article 15
Phasing-in period
Article 16
Commission reports
By 31 October 2021, the Commission shall submit a report to the European Parliament and to the Council. The report shall include an overview of:
the number of certificates issued pursuant to this Regulation;
guidance requested pursuant to Article 3(11) on the available scientific evidence and level of standardisation regarding the possible issuance of certificates of recovery based on antibody tests, including serological testing for antibodies against SARS-CoV-2, taking into account the availability and accessibility of such tests; and
the information received pursuant to Article 11.
The report shall contain, in particular, an assessment of the impact of this Regulation on the facilitation of free movement, including on travel and tourism and the acceptance of the different types of vaccine, fundamental rights and non-discrimination, as well as on the protection of personal data during the COVID-19 pandemic.
The report may be accompanied by legislative proposals, in particular to extend the period of application of this Regulation, taking into account the evolution of the epidemiological situation with regard to the COVID-19 pandemic.
Article 17
Entry into force
This Regulation shall enter into force on the day of its publication in the Official Journal of the European Union.
It shall apply from 1 July 2021 to 30 June 2022.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
ANNEX
CERTIFICATE DATASETS
Data fields to be included in the vaccination certificate:
name: surname(s) and forename(s), in that order;
date of birth;
disease or agent targeted: COVID-19 (SARS-CoV-2 or one of its variants);
COVID-19 vaccine or prophylaxis;
COVID-19 vaccine product name;
COVID-19 vaccine marketing authorisation holder or manufacturer;
number in a series of doses as well as the overall number of doses in the series;
date of vaccination, indicating the date of the latest dose received (certificates held by persons aged 18 and above indicating the completion of the primary vaccination series shall be accepted only if not more than 270 days have passed since the date of the latest dose in that series);
Member State or third country in which the vaccine was administered;
certificate issuer;
unique certificate identifier.
Data fields to be included in the test certificate:
name: surname(s) and forename(s), in that order;
date of birth;
disease or agent targeted: COVID-19 (SARS-CoV-2 or one of its variants);
the type of test;
test name (optional for NAAT test);
test manufacturer (optional for NAAT test);
date and time of the test sample collection;
result of the test;
testing centre or facility (optional for rapid antigen test);
Member State or third country in which the test was carried out;
certificate issuer;
unique certificate identifier.
Data fields to be included in the certificate of recovery:
name: surname(s) and forename(s), in that order;
date of birth;
disease or agent from which the holder has recovered: COVID-19 (SARS-CoV-2 or one of its variants);
date of first positive test result;
Member State or third country in which test was carried out;
certificate issuer;
certificate valid from;
certificate valid until (not more than 180 days after the date of first positive test result);
unique certificate identifier.