EUROPEAN COMMISSION
Brussels, 22.12.2022
COM(2022) 753 final
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL
pursuant to Article 16(3) of Regulation (EU) 2021/953 of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic
1.Introduction
On 14 June 2021, the European Parliament and the Council adopted Regulation (EU) 2021/953 establishing the EU Digital COVID Certificate (the ‘EU Digital COVID Certificate Regulation’). The Regulation sets out a common framework for the issuance, verification and acceptance of interoperable certificates for COVID-19 vaccination, test or recovery certificates to facilitate free movement of EU citizens and their family members during the COVID-19 pandemic. The Regulation is accompanied by Regulation (EU) 2021/954, which extends the EU Digital COVID Certificate framework to third-country nationals who are legally staying or residing in a Member State’s territory and who are entitled to travel to other Member States in accordance with EU law.
The EU Digital COVID Certificate Regulations seeks to facilitate free movement by providing citizens with interoperable and mutually accepted certificates on COVID-19 vaccination, testing and recovery that they can use when travelling. On 29 June 2022, the European Parliament and the Council extended the Regulations until 30 June 2023. That extension ensured that travellers could continue using their certificate should a significant worsening of the epidemiological situation make it necessary for Member States to temporarily reintroduce travel restrictions.
At the same time, the extension of the EU Digital COVID Certificate framework does not require Member States to maintain or impose free movement restrictions. Any restrictions to the free movement of persons within the EU put in place to limit the spread of SARS-CoV-2, including the requirement to present EU Digital COVID Certificates, should be lifted as soon as the epidemiological situation allows. The EU Digital COVID Certificate, together with the Council Recommendation on the coordinated approach on free movement during the COVID-19 pandemic, has indeed contributed to a coordinated lifting of restrictions: since August 2022, all Member States have lifted all intra-EU travel restrictions, including the requirement to present an EU Digital COVID Certificate. In its latest proposal for an update to the Council Recommendation, the Commission considers that, within the EU, this absence of pandemic-related restrictions to free movement should remain the norm, unless the epidemiological situation were to worsen severely.
The EU Digital COVID Certificate has been a crucial element in Europe’s response to the COVID-19 pandemic and has rapidly become a standard in Europe and beyond. Since its launch, Member States have issued more than 2 billion EU Digital COVID Certificates. Its success served to accelerate the digitalisation of healthcare across the Member States. The Regulation also has an important international dimension, as it empowers the Commission to connect COVID-19 certificate systems in third countries. Currently, 49 third countries and territories across five continents have joined the system, in addition to the 27 Member States.
In line with the EU Digital COVID Certificate Regulation, the Commission submitted reports to the European Parliament and to the Council in October 2021 (the ‘October 2021 report’) and March 2022 (the ‘March 2022 report’). These reports provided an overview of the implementation of the Regulation since its adoption on 14 June 2021. The March 2022 report also included an assessment of the impact of the Regulation on the facilitation of free movement, fundamental rights and non-discrimination, as well as on the protection of personal data during the COVID-19 pandemic.
When extending the Regulation, the European Parliament and the Council provided that the Commission must submit another report by 31 December 2022. This third report is to contain, in particular, an overview of the information received on the implementation of the Regulation, an overview describing all the developments regarding the domestic and international uses of the certificates and the adoption of implementing acts pursuant to Article 8(2) of the Regulation, and any relevant updates regarding the assessment of the impact of the Regulation set out in the previous report. The report is also to contain an assessment of the appropriateness of the continued use of the certificates for the purposes of the Regulation, taking into account epidemiological developments and the latest available scientific evidence.
Apart from the topics explicitly mentioned in the Regulation, this report also contains updated information on the number of EU Digital COVID Certificates issued, the latest technical developments related to the EU Digital COVID Certificate system, and information on the changes introduced with the extension of the Regulation. As a follow-up to the previous report, it also contains updated information on the acceptance period of vaccination certificates and other relevant developments on test, recovery and vaccination certificates. Finally, the report outlines the Commission’s reflections as to the period of application of the Regulation and potential other use cases.
2.Application of the EU Digital COVID Certificate Regulation and its impact on fundamental rights and non-discrimination
2.1.Facilitation of free movement
2.1.1.Coordination of free movement restrictions linked to the COVID-19 pandemic – use of EU Digital COVID Certificate in the context of intra-EU travel
As explained also in more detail in the March 2022 report, the fundamental right of free movement is enshrined in Article 21(1) of the Treaty on the Functioning of the European Union and Article 45 of the Charter of Fundamental Rights. Its exercise may be subject to limitations, as long as these are applied in compliance with relevant EU rules and general principles.
During the COVID-19 pandemic, Member States took measures that limited the exercise of the right to move and reside freely within the EU in order to protect public health. Such limitations must respect EU law principles such as proportionality and non-discrimination. Any measures taken should not extend beyond what is strictly necessary to safeguard public health. The Commission also continued to underline this obligation in its different proposals adopted on the issue of free movement during the COVID-19 pandemic.
As noted by the General Court (more details in Section 2.1.4), the Regulation does not require Member States to introduce limitations on the right to free movement. However, the Regulation ensures that, where Member States waive certain restrictions on free movement for persons in possession of proof of vaccination, test or recovery, citizens can benefit, in a non-discriminatory manner, from these exemptions on the basis of certificates issued in line with the Regulation.
The Regulation extending the EU Digital COVID Certificate framework makes clear that this extension should not be understood as requiring Member States, in particular those that lift domestic public health measures, to maintain or impose restrictions on free movement. Any restrictions to the free movement of persons within the EU put in place to limit the spread of SARS-CoV-2s, including the requirement to present EU Digital COVID Certificates, should be lifted as soon as the epidemiological situation allows doing so.
To ensure coordination across the EU, the Commission continued its efforts to ensure a well-coordinated approach to the adoption of restrictions on freedom of movement. On 14 October 2022, the Commission proposed another update to the coordinated approach on travel within the EU during the COVID-19 pandemic to reflect the improved epidemiological situation, which was adopted by the Council on 13 December 2022. As outlined in the proposal, the Commission considers that within the EU, the absence of pandemic-related restrictions to free movement should remain the norm. Requirements to be in the possession of a valid EU Digital COVID Certificate should be reintroduced only if the epidemiological situation would worsen severely.
Only in response to a new variant of concern or interest could additional measures – apart from the requirement to present an EU Digital COVID Certificate – be taken, with the aim of slowing down its spread, buying time to mobilise surge hospital capacity, and triggering vaccine development. This ‘emergency brake’ could also be used in situations where the epidemiological situation worsens rapidly and severely in a way that suggests the emergence of a new SARS-CoV-2 variant of concern or interest.
Where a Member State introduces a requirement to present a valid EU Digital COVID Certificate, or where it takes additional measures in accordance with the emergency brake procedure, it should swiftly inform the Commission and other Member States accordingly through the Integrated Political Crisis Response (IPCR) network and provide information as to the reasons, expected impact, entry into force and duration of any such travel restrictions. Lastly, as the traffic light map
had become an inadequate depiction of the epidemiological situation in the EU, the Commission proposed its deletion.
Overall, the intended approach has been successful: the EU Digital COVID Certificate has facilitated free movement when travel restrictions were considered necessary by the Member States, and has, at the same time, allowed for a coordinated lifting of these restrictions from the moment it was possible. Requirements to hold EU Digital COVID Certificates for intra-EU travel decreased as the epidemiological situation improved. While in March 2022, after the previous report was adopted, 17 Member States were still requiring travellers to be in the possession of an EU Digital COVID Certificate, this number had dropped to 7 Member States in May 2022, and eventually to 0 Member States in August 2022 (see graph). Hence, by August 2022, all Member States had lifted all intra-EU travel restrictions. This shows that, even during momentary peaks of infections such as the wave driven by the Omicron BA.4 and BA.5 sub-variants observed during the summer of 2022, Member States did not see a need to reintroduce travel restrictions.
2.1.2.Information received pursuant to Article 11 of the EU Digital COVID Certificate Regulation
The EU Digital COVID Certificate Regulation provides that additional restrictions on EU Digital COVID Certificate holders are only possible where these are necessary and proportionate to safeguard public health in response to the COVID-19 pandemic. Member States have an obligation to inform the Commission and other Member States 48 hours in advance whenever they decide to impose additional restrictions. In the two previous reports, the Commission summarised the notifications received pursuant to this provision. No such notifications were received since the last Report in March 2022.
The Commission has continued to monitor Member States’ implementation of the EU Digital COVID Certificate Regulation and of the Council Recommendation on a coordinated approach to facilitate safe free movement during the COVID-19 pandemic. Information from Member States on the EU Digital COVID Certificate was collected by means of overview tables submitted by the Member States to the Commission and the Council. Since the lifting of the last intra-EU travel restrictions in August 2022, the Commission has put this information gathering exercise on hold but may resume it if necessary.
2.1.3.Follow-up to the previous reports: impact on travel and tourism, acceptance of different types of vaccine, fundamental rights and non-discrimination, as well as protection of personal data
2.1.3.1.Fundamental rights and non-discrimination
The March 2022 report outlined how the EU Digital COVID Certificate Regulation ensures a non-discriminatory approach by including interoperable vaccination, test and recovery certificates. While it remains a policy decision (in the field of public health) of the Member States which types of certificates they accept, the Regulation ensures that EU Digital COVID Certificates issued for the same medical event are accepted, for the purpose of waiving free movement restrictions, under the same conditions. This assessment still stands.
2.1.3.2.Acceptance of different types of COVID-19 vaccines
2.1.3.2.1COVID-19 vaccines undergoing clinical trials
As explained in more detail in Section 2.4.2 below, when extending the EU Digital COVID Certificate Regulation, the European Parliament and Council also included an amendment providing that Member States may issue an EU Digital COVID Certificate to persons participating in ongoing clinical trials for COVID-19 vaccines, and that such certificates may be accepted by other Member States in order to waive restrictions to free movement. Moreover, the Regulation tasks the Health Security Committee (HSC)
with issuing guidance to ensure coherence over the acceptance of these certificates across the EU.
The Commission set up an HSC Technical Working Group on EU Digital COVID vaccination certificates issued to COVID-19 clinical trial participants with the aim to draft guidance on a single approach. The resulting “Guidance on the mutual acceptance of EU Digital COVID Certificates issued to participants of clinical trials” was adopted by the HSC on 5 October 2022. The guidance sets out that Member States should mutually accept certificates for all ongoing clinical trials, without differentiation. This approach should apply to all EU/EEA publicly available clinical trials on COVID-19 vaccines listed in the European Union Drug Regulating Authorities Clinical Trials Database (EudraCT) or in the Clinical Trials Information System (CTIS), managed by the European Medicines Agency (EMA). A limited selection of key international trials should also be considered; however, these are currently not yet included.
2.1.3.2.2COVID-19 vaccines that have completed WHO emergency use listing procedure
As provided in the EU Digital COVID Certificate Regulation, Member States are obliged to accept vaccination certificates for vaccines that have received EU marketing authorisation when it comes to waiving free movement restrictions. In addition, Member States may, but are not obliged to, also waive restrictions for travellers who have received a vaccine that has completed the World Health Organization (WHO) emergency use listing procedure or that has been authorised at national level in another Member State.
As explained in the previous report, there has been increasing acceptance by Member States of vaccines having completed the WHO emergency use listing procedure. Council Recommendation (EU) 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction already provided that Member States should lift the temporary restriction on non-essential travel to the EU also for persons vaccinated with a WHO-listed vaccine (although such travellers might still be subject to additional requirements).
In its proposal for a new Council Recommendation on travel into the EU (replacing the current Council Recommendation 2020/912), the Commission has suggested that all COVID-19 related restrictions for travellers to the Union should be lifted, but, where relevant, WHO-approved vaccines should be accepted. To further facilitate the exercise of free movement of EU citizens who have been administered a WHO-listed vaccine, and to ensure coherence between travel into the EU and intra-EU travel, the Commission proposed, in its latest update to the coordinated approach on travel within the EU (see Section 2.1.1 above), that Member States, where they would reintroduce restrictions on intra-EU travel, should also be recommended to accept EU Digital COVID Certificates issued following the administration of such vaccines. These Commission proposals were adopted by the Council on 13 December 2022.
2.1.3.3.Impact on travel and tourism
The March 2022 report outlined how the EU Digital COVID Certificate contributed positively to restoring international travel to the EU and beyond, and also included data on commercial flights. Since then, the data shows that, at EU level, the number of flights was higher in 2022 than in 2021 in all months except January and February. By October 2022, air traffic recovered to -15% of the level of 2019. According to Eurocontrol’s latest forecast, it is expected to fully recover to 2019 levels at some point in 2024.
2.1.3.4.Protection of personal data
The March 2022 report included an assessment of the compliance of the EU Digital COVID Certificate Regulation with EU data protection rules. The Commission has also ensured that all implementing and delegated acts adopted pursuant to the provisions of the Regulation comply with the principle of data minimisation. This assessment still stands.
When it comes to the third countries connected to the system (see Section 2.5.1), it is important to underline that participating countries have to comply with relevant cybersecurity and data protection legislation – the enforcement of which is in the hands of specific national authorities – when establishing and operating their national systems and services. The Commission systematically requires all Member States and third countries to submit a self-assessment to provide additional assurance that the country has taken specific account of particular risks, including as regards data protection. A rigorous ‘onboarding’ process is applied to all participating countries, and any failure to adhere to any of these requirements prevents connection to the EU Digital COVID Certificate framework.
2.1.4.Other information on the implementation of the EU Digital COVID Certificate Regulation
Since the March 2022 report, the General Court has issued several orders regarding the EU Digital COVID Certificate Regulation.
Abenante and others v Parliament and Council concerned an action for annulment of the Regulation. The applicants claimed that the Regulation tied the exercise of free movement to the obligation to undergo invasive health care, namely vaccination and COVID-19 testing. The applicants also claimed that the Regulation discriminated against non-vaccinated EU citizens.
The General Court dismissed the action as inadmissible, considering that the EU Digital COVID Certificate Regulation merely establishes a common framework for the issuance, verification and acceptance of interoperable vaccination, test and recovery certificates, but does not lay down an obligation to be vaccinated against COVID-19 or to carry out a test, nor an obligation to be in possession of such a certificate to exercise the right to free movement. Any such obligation as a condition of entry into the territory of a Member State derives solely from the national law of the Member States.
The General Court also observed that the Regulation allows for a differentiation between vaccination, test and recovery certificates, depending on the choices made by each Member State. The Regulation establishes an obligation on Member States to accept the certificates in question, where they waive certain restrictions on travel for people who have proof of vaccination, test or recovery.
The General Court also highlighted that, if the EU Digital COVID Certificate Regulation were annulled, Member States could still restrict travelling on grounds of protection of public health by making it conditional on the provision of evidence of vaccination, test or recovery. At the same time, Member States would in that case no longer be obliged to accept certificates issued by other Member States. The annulment would therefore have the effect of depriving travellers of the possibility of presenting a certificate of vaccination, test or recovery issued by their Member State of origin in order to fulfil the obligations imposed by another Member State.
In addition, the General Court dismissed two cases contesting Commission Delegated Regulation (EU) 2021/2288 of 21 December 2021, which established a binding acceptance period of 270 days for vaccination certificates covering the primary vaccination series, for the purposes of intra-EU travel. In both cases, the applicants claimed that the Delegated Regulation exceeded the empowerment given to the Commission and affected their right to free movement in a disproportionate manner. The General Court held that both actions were inadmissible, again underlining that the EU Digital COVID Certificate Regulation, including as modified by the Delegated Regulation, does not impose an obligation to present an EU Digital COVID Certificate to exercise the right to free movement. The same applies to the consequences that the Member States draw from the invalidity of such certificates upon expiry of the 270-day acceptance period. The Delegated Regulation does not include any obligation, even indirect, to get a booster dose upon expiry of the acceptance period of the primary vaccination series.
Lastly, as explained in the March 2022 report, the Commission has continuously sought to provide citizens with accurate and user-friendly information on the EU Digital COVID Certificate and travel restrictions, for example by setting up the Re-open EU platform and by publishing answers to the most frequently asked questions on these topics. The Re-open EU platform has continuously been improved in terms of usability and has witnessed around 44.7 million visits since it was published in June 2020, which gives an average of 51 500 visits per day. In addition, the Commission has provided input to the Europe Direct Contact Centres, which replied to 55 725 questions related to the coronavirus pandemic (including many questions on travel rules) in 2021.
2.2.Use of the EU Digital COVID Certificate for domestic purposes
The EU Digital COVID Certificate Regulation covers the use of the certificate to facilitate travel within the EU during the COVID-19 pandemic. As explained in the previous reports, EU law neither prescribes nor prohibits the domestic use of EU Digital COVID Certificates. This means that the domestic use of EU Digital COVID Certificates remains a matter for Member States to decide. It is up to Member States to determine which health protection measures they consider most appropriate in the context of accessing, for example, the workplace, cultural events, restaurants, etc. Member States may indeed use the EU Digital COVID Certificates for such domestic purposes but are required to provide for a legal basis in national law, which must comply, among others, with data protection requirements.
In a survey conducted in November 2022, all responding Member States indicated that they have used the EU Digital COVID Certificate for such purposes. Member States most commonly used the certificate for access to events, cultural activities or to restaurants. Many Member States also used the certificate for access to healthcare facilities, wellness centres or hotels. In addition, the certificate was often used as a proof of vaccination, test or recovery in a medical context. Less commonly, the certificate was used for access to the workplace or schools/universities, or for public transportation.
Similarly to intra-EU travel use, the domestic use of EU Digital COVID Certificates decreased as the epidemiological situation improved. In March 2022, after the March 2022 report was adopted, 18 Member States still indicated that they were making use of the EU Digital COVID Certificate for domestic purposes. This number had dropped to 9 Member States in May 2022, and eventually to 5 Member States in August 2022 (see graph). Those 5 remaining Member States use the EU Digital COVID Certificate for limited use cases, i.e. access to health care facilities and nursing homes.
2.3.Technical implementation
2.3.1.Number of EU Digital COVID Certificates issued
By 31 October 2022, Member States have issued more than 2.2 billion EU Digital COVID Certificates, made up of 1.4 billion vaccination certificates, 660.8 million test certificates, and 96.4 million certificates of recovery. A detailed breakdown per Member State is included in Annex I.
2.3.2.EU Gateway and work at technical level
2.3.2.1.Developments since the March 2022 report
The technical specifications, standards and guidelines for the common issuance, verification and acceptance of the EU Digital COVID Certificate were jointly developed by the Commission and the Member States within the framework of the eHealth Network. All of the specifications developed by the eHealth Network are based on open standards and are published as open source on the eHealth Network website and GitHub. This has facilitated interoperability with systems developed by third countries.
Since March 2022, work at technical level to further improve the EU Digital COVID Certificate system has included the adoption of a mechanism for the automatic exchange of lists of revoked EU Digital COVID Certificates via the EU Digital COVID Certificate Gateway, the central part of the trust framework. It also included an update to the technical specifications to reflect the new possibilities included in the extension of the EU Digital COVID Certificate regarding the issuance of vaccination certificates for ongoing clinical trials and the issuance of recovery and test certificates on the basis of laboratory-based antigen tests.
2.3.2.1.Mechanism to exchange lists of revoked certificates
Revoking certificates may help safeguarding public health when certificates have been issued erroneously, because of fraud or following the suspension of a COVID-19 vaccine batch found to be defective. In this context, the EU Digital COVID Certificate Regulation already provided that its trust framework may support the bilateral exchange of certificate revocation lists, which are lists that contain the unique certificate identifiers of revoked certificates
. Certificate revocation lists exchanged should not contain any personal data other than unique certificate identifiers.
To facilitate the cross-border automatic exchange of certificate revocation lists via the central EU Digital COVID Certificate Gateway in full compliance with data privacy and data protection requirements, the Commission, in cooperation with the Member States, developed the revocation mechanism specifications, which are set out in Commission Implementing Decision (EU) 2022/483. The revocation mechanism consists of two parts. The first part pertains to the EU Digital COVID Certificate Gateway and is binding in its application. The second part relates to how Member States distribute the revocation lists from their national infrastructure to their verifier applications and is non-binding. For the latter, Member States are free to choose among a range of different options, all of which take privacy concerns into account.
2.3.2.1.Changes to the technical specifications as a result of Regulation (EU) 2022/1034
As explained in more detail in Sections 2.4.1 and 2.4.2, the amendment extending the EU Digital COVID Certificate Regulation also allows for the issuance of certificates for COVID-19 vaccines undergoing clinical trials and the issuance of recovery and test certificates on the basis of laboratory-based antigen tests. Commission Implementing Decision (EU) 2022/1516 was adopted to reflect these changes in the technical specifications and rules to populate the EU Digital COVID Certificate, complemented by an updated version of the Guidelines on Value Sets for EU Digital COVID Certificates.
2.3.2.2.Encoding of adapted COVID-19 vaccines
Following recommendations by EMA, the Commission adopted, on 1 September 2022, decisions on the EU-wide authorisation of the adapted COVID-19 vaccines Comirnaty Original/Omicron BA.1 and Spikevax bivalent Original/Omicron BA.1, which are adapted versions of the original vaccines Comirnaty (Pfizer/BioNTech) and Spikevax (Moderna) to target the Omicron BA.1 subvariant in addition to the original strain of SARS-CoV-2. Later that month, the Commission also authorised Comirnaty Original/Omicron BA.4-5, an adapted COVID-19 vaccine targeting the Omicron subvariants BA.4 and BA.5 in addition to the original strain of SARS-CoV-2, following a corresponding recommendation from EMA. With Spikevax bivalent Original/Omicron BA.4-5, the Commission authorised a second bivalent Original/Omicron BA.4-5 vaccine on 20 October 2022.
The Commission consulted the Health Security Committee on the question as to how to encode these adapted vaccines in the EU Digital COVID Certificate. In response, most Member States did not see a strong need to differentiate, in the EU Digital COVID Certificate, between adapted vaccines and their original version for the purposes of facilitating free movement. At the same time, many Member States do differentiate between the different vaccine types in their national healthcare systems or databases for other purposes, notably pharmacovigilance and public health. As a result, adapted COVID-19 vaccines are encoded in the EU Digital COVID Certificate in the same way as the corresponding original version. For reasons of preparedness, the eHealth Network nevertheless prepared a proposal as to how such adapted vaccines could be encoded differently, should there be a decision that such a differentiation would be necessary.
In the eHealth Network’s updated Guidelines on Value Sets for EU Digital COVID Certificates published on 19 October 2022, the encoding of adapted COVID-19 vaccines is described as outlined above.
2.3.2.1.Encoding of COVID-19 vaccines with three primary doses
Following EMA’s recommendation, the Commission approved, on 20 October 2022, paediatric formulations of Comirnaty and Spikevax COVID-19 vaccines for children from 6 months of age. In the case of Comirnaty, the primary vaccination consists of three doses, with the individual doses being lower compared to those for already authorised age groups. Previously, EU-approved COVID-19 vaccines had been single-dose or two-dose vaccines.
In this context, the Commission clarified the encoding of this three-dose paediatric formulation of Comirnaty in the EU Digital COVID Certificate to Member States and representatives of third countries and territories connected to the EU Digital COVID Certificate Gateway. This clarification did not require a modification of the technical specifications.
2.4.Developments regarding EU Digital COVID Certificates
2.4.1.Extension: inclusion of laboratory-based antigen tests
Prior to its extension, the EU Digital COVID Certificate Regulation provided that test certificates may be issued on the basis of two types of tests for SARS-CoV-2 infection only, namely molecular nucleic acid amplification tests (NAAT tests), including those using reverse transcription polymerase chain reaction (RT-PCR), and rapid antigen tests, which rely on the detection of viral proteins (antigens) using a lateral flow immunoassay that gives results in less than 30 minutes, provided they are carried out by health professionals or by skilled testing personnel. When extending the Regulation, the Parliament and the Council included high-quality laboratory-based antigen assays among the types of tests for which an EU Digital COVID Certificate can be issued, to widen the scope of the types of diagnostic tests at a time where COVID-19 tests are in high demand.
Indeed, from July 2021, the technical working group on COVID-19 diagnostic tests, which is responsible for preparing updates to the EU common list of COVID-19 antigen tests agreed by the Health Security Committee, has been reviewing the proposals put forward by Member States and manufacturers for COVID-19 laboratory-based antigenic assays. Those proposals have been assessed against the same criteria as those used for rapid antigen tests, and the Health Security Committee has established a list of the laboratory-based antigenic assays that meet those criteria.
As a result, Member States are now able to issue test certificates and recovery certificates on the basis of the laboratory-based antigenic assays included in the EU common list of COVID-19 antigen tests.
2.4.2.Extension: inclusion of vaccination certificates for clinical trial participants
In light of the emergence of new SARS-CoV-2 variants of concern, the continued development and study of COVID-19 vaccines is a crucial factor in the fight against the COVID-19 pandemic. In that context, it is important to facilitate the participation of volunteers in clinical trials, that is, studies performed to investigate the safety or efficacy of a medicine, such as a COVID-19 vaccine. Clinical research plays a fundamental role in the development of vaccines and voluntary participation in clinical trials therefore needs to be encouraged. Preventing participants in clinical trials from obtaining vaccination certificates could constitute a major disincentive to participating in such trials, delaying the conclusion of such trials and, more generally, having a negative impact on public health. The Commission therefore wanted to facilitate and encourage participation in clinical trials.
The extension of the Regulation provides that Member States may issue an EU Digital COVID Certificate to persons participating in ongoing clinical trials for COVID-19 vaccines which have not yet been granted a marketing authorisation, regardless of whether the participant received the COVID-19 vaccine candidate or the dose administered to the control group, as long as the trial has been approved by Member States’ ethical committees and competent authorities. Such certificates may be accepted by other Member States in order to waive restrictions to free movement, unless their acceptance period has expired or they have been revoked following the conclusion of the clinical trial, in particular on the grounds that the COVID-19 vaccine was subsequently not authorised or that the vaccination certificates were issued for a placebo administered to the control group as part of a blinded trial.
As explained in Section 2.1.3.2.1 above, the Health Security Committee adopted guidance on a mutual approach for the acceptance of these certificates on 5 October 2022, which includes a list of ongoing clinical trials that Member States agree to accept mutually, to be updated when necessary.
2.4.3.Validity period of vaccination certificates
As explained in the March 2022 report, the Commission adopted, in December 2021, Delegated Regulation (EU) 2021/2288 establishing a binding acceptance period of 270 days for vaccination certificates covering the primary vaccination series for the purposes of intra-EU travel. Such certificates are therefore not to be accepted if more than 270 days have passed since the last dose.
On 29 March 2022, the Commission adopted Delegated Regulation (EU) 2022/503 exempting minors from the 270-day acceptance period for primary vaccination certificates. Although EMA had recommended the administration of vaccines for adolescents aged 12 or more, it also noted that it was for the experts guiding the vaccination campaign in each Member State to advise on the optimum decision and timing for their country. When consulted by the Commission, a large number of Member States considered that, irrespective of whether booster vaccinations were offered to minors nationally, it was appropriate to exempt these minors from the standard acceptance period.
The maximum acceptance period of 270 days currently does not apply to vaccination certificates issued for booster doses – regardless whether they have been issued following the administration of a first or second booster – meaning that they currently are to be accepted with no expiry date.
2.4.4.Other issues
No new scientific evidence has emerged since the March 2022 report to justify a change to the policy not to issue recovery certificates based on results from antibody tests. The reasons laid out in that report remain up-to-date. Likewise, there is no change in the position regarding the validity period of certificates of recovery.
2.5.International aspects of the EU Digital COVID Certificate system
2.5.1.Connecting Europe and third countries
The EU Digital COVID Certificate Regulation stipulates that the Commission can issue a decision establishing that the certificates of a third country are to be considered as equivalent to EU Digital COVID Certificates (‘equivalence decisions’) for the purpose of facilitating their holders’ exercise of their right of free movement. This results in the third country concerned being connected to the EU Gateway. Detailed information on this process can be found in the October 2021 report.
In addition to the 27 Member States, 49 non-EU countries and territories have been connected to the EU Digital COVID Certificate system for the purpose of facilitating the right of free movement within the EU. This brings the total number of countries and territories connected to the EU Digital COVID Certificate system to 76, making it the largest system of interoperable COVID-19 certificates worldwide.
Since the adoption of the March 2022 report and by the end of November 2022, the Commission adopted additional equivalence decisions regarding Bahrain, Brazil, Colombia, Ecuador, Indonesia, the Republic of Korea, Kosovo, Madagascar, Malaysia, Oman, Peru, the Philippines, Seychelles, and Vietnam.
The Regulation as such does not explicitly require that third countries seeking an equivalence decision reciprocally accept the EU Digital COVID Certificate for travelling to their respective countries. However, before adopting an equivalence decision, the Commission has systematically asked all third countries concerned to accept the EU Digital COVID Certificate and to guarantee that they uphold data protection requirements. As explained in Section 2.1.3.4, a rigorous ‘onboarding’ process is applied to all third countries wishing to participate to verify their compliance with security requirements.
In order to obtain an overview as to the status of implementation of equivalence decisions, a questionnaire was sent by EU Delegations to the third countries and territories whose certificates are covered by equivalence decisions and who have been part of the system for a sufficient period of time to provide feedback. The 27 countries and territories that provided input to the questionnaire reported very few problems concerning vaccination, recovery, and test certificates and data protection. The few issues reported have since been addressed or fall outside of EU competence.
2.5.2.Interoperability with systems developed at international level
In accordance with Article 4(3) of the Regulation, the EU Digital COVID Certificate trust framework should ensure interoperability with technological systems established at international level.
The Commission has maintained an ongoing dialogue and cooperation with international institutions and organisations to explore options for interoperability among the existing technological systems. In March 2022, the Indonesian presidency of the G20, supported by the WHO, Organization for Economic Cooperation and Development and the Global Digital Health Partnership launched a pilot project to test the technological feasibility of harmonising COVID-19 global health protocol standards, including by developing a universal verifier application that can validate COVID-19 certificates issued under different technical standards, in full compliance with national legal and health frameworks. The Commission and some Member States actively participate in the discussions, sharing know-how, experience and lessons learned from the EU Digital COVID Certificate as the major digital COVID-19 certificate system implemented at global level.
In the context of the negotiations on an international agreement on pandemic prevention, preparedness and response, as well as amendments to the International Health Regulations (2005) (‘IHR’), the negotiating directives annexed to the Council Decision (EU) 2022/451 of 3 March 2022 authorising the Commission to negotiate on behalf of the EU for issues falling under EU competence, provide that amendments to the International Health Regulations should aim at clarifying and strengthening existing provisions, including by promoting the use of new digital tools that may improve their implementation.
On 30 September 2022, the EU and its Member States submitted a set of proposed amendments to the IHR, including one proposed amendment which aims at enabling the use of digital vaccination certificates for international travel. This proposal is now being considered, together with all proposed amendments submitted by other State Parties to the International Health Regulations, in a Working Group composed of members of the World Health Organization, with the view of proposing a package of targeted amendments for the consideration and possible adoption by the World Health Assembly in May 2024.
2.6.Future of the EU Digital COVID Certificate
Article 16(3) of the EU Digital COVID Certificate Regulation provides for this report to assess the appropriateness of the continued use of the EU Digital COVID Certificate for the purposes of the Regulation, taking into account epidemiological developments and the latest available scientific evidence. In addition, the Regulation underlines that, without prejudice to the Commission’s right of initiative, the report may be accompanied by a legislative proposal, in particular to shorten the period of application of this Regulation, currently 30 June 2023.
As far as the period of application of the EU Digital COVID Certificate Regulation is concerned, the Commission would like to reaffirm that the extension of the Regulation in June 2022 until June 2023 was necessary in view of the remaining uncertainties regarding the evolution of the COVID-19 pandemic. It was important to avoid a situation in which, in the event that certain restrictions to free movement based on public health remained in place after 30 June 2022, EU citizens would have been deprived of the possibility of using an important tool that had facilitated free movement until that moment.
As the Commission has continuously emphasised, any restrictions to the free movement of persons within the EU put in place to limit the spread of SARS-CoV-2 should be lifted as soon as the epidemiological situation allows. This also applies to requirements to present EU Digital COVID Certificates.
Since the March 2022 report and the extension of the Regulation, the Omicron variant has – in the form of different sub-variants – remained the dominant variant in the EU. Omicron is less severe than the previously observed Delta variant, which can be attributed at least partially to the protective effect of vaccination and previous infection. As a result, and in combination with these higher levels of protection, pressure on healthcare systems currently remains at manageable levels, even during momentary peaks of infections such as the wave driven by the Omicron BA.4 and BA.5 sub-variants observed during the summer of 2022 or the wave observed in mid-October 2022. On 20 October 2022, the European Centre for Disease Prevention and Control (ECDC) designated a new sub-variant BQ.1, including its sub-lineages, as variant of interest. Based on modelling estimates, it is expected that by the beginning of 2023, more than 80% of SARS-CoV-2 cases will be due to BQ.1 and its sub-lineages (see also Annex II for the input received from ECDC).
By August 2022, Member States had indeed lifted all measures affecting free movement of persons in the EU, including the requirement for travellers to hold an EU Digital COVID Certificate. In addition, during the subsequent momentary peaks of infections, no Member State re-introduced requirements for travellers to hold EU Digital COVID Certificates. This is because in the current situation, domestic factors can be expected to be more powerful drivers of the epidemiological situation than cross-border travel. As a result, domestic non-pharmaceutical interventions, such as mask-wearing, ventilation and physical distancing, rather than travel restrictions, may be effective in slowing down the spread of COVID-19, if implemented early and comprehensively and sufficiently put into practice by society. In addition, the Commission is not aware of any plans by Member States to re-introduce travel restrictions. As also noted by ECDC, “the current variant and immunity landscapes in the EU/EEA countries suggest that the impact/value of the use of EU Digital COVID Certificates would be currently low from a public health perspective” (see Annex II for the input received from ECDC).
In view of the above, the Commission is of the opinion that the EU Digital COVID Certificate Regulation has achieved its intended purposes, namely to facilitate the holders’ exercise of their right to free movement during the COVID-19 pandemic and to contribute to facilitating the gradual lifting of restrictions to free movement put in place by the Member States, in accordance with EU law, to limit the spread of SARS-CoV-2, in a coordinated manner.
Nevertheless, as also noted in the Communication of 2 September 2022, the Commission considers that it is necessary to remain vigilant over the coming winter months. As also indicated by ECDC, there are certain key elements that will be particularly decisive for the timing and magnitude of future COVID-19 waves. First, the vaccine-induced and naturally-acquired protection against infection and severe outcomes wanes over time, which has a substantial impact on the likelihood and severity of future waves of infections. Second, the emergence of more immune-evasive or transmissible (sub-)lineages of SARS-CoV-2 will be a crucial factor which will, together with any change in severity of new variants, be decisive for the related disease burden. Third, temporal fluctuations of COVID-19 will be amplified or reduced by human behaviour. Lastly, there might be potential for seasonality patterns to arise that are caused by other factors such as climate, which can result in oscillations of the COVID-19 burden over the year. As far as the BQ.1 variant of interest is concerned, there is, based on limited available data, no evidence of it being associated with a greater infection severity than the circulating variants BA.4/BA.5. Still, ECDC underlines that Member States should remain vigilant for signals of its emergence and spread.
It is in this context that the Commission, in its proposal of 14 October 2022 to update the coordinated approach on travel within the EU during the COVID-19 pandemic
(see also Section 2.1.1), underlined that the absence of pandemic-related restrictions to free movement should, at this point in time, remain the norm. Member States should reintroduce requirements to be in the possession of a valid EU Digital COVID Certificate only if the epidemiological situation would worsen severely. To make this determination, Member States should in particular take into account the strain on their healthcare systems due to COVID-19, notably in terms of admissions and number of hospital and intensive-care unit inpatients.
It is thus primarily for reasons of epidemiological vigilance that the Commission does not intend to adopt a proposal to shorten the period of application of the Regulation. Any such proposal would also create legal uncertainty for Member States and connected third countries seeking to plan and prepare for the Regulation’s expiry.
At the same time, the Commission does not intend, at this stage, to propose a further extension of the EU Digital COVID Certificate Regulation beyond its current expiry date of 30 June 2023. As ECDC has also pointed out, the most acute phase of the COVID-19 pandemic has passed. Thus, the Commission considers that it is unlikely that restrictions to the fundamental right to free movement will be justified going forward. In a survey conducted in the IPCR network in November 2022, when asked whether they would expect a need for EU Digital COVID Certificates for the purpose of intra-EU travel after June 2023, no Member State clearly indicated such a need
. The Commission will re-assess the situation by the end of March 2023 with a view to making a definitive decision as to its position regarding the period of application of the Regulation.
It is also important to note that, on 19 September 2022, the Commission adopted a proposal for a Regulation establishing a Single Market Emergency Instrument
. This instrument aims to put in place a flexible and transparent mechanism to respond quickly to emergencies and crises that threaten the functioning of the single market. The objective is to ensure coordination, solidarity and coherence of the EU crisis response and protect the single market’s functioning, ensuring, in particular, the continued free movement of persons, goods, and services. According to the proposal, the Commission and the Member States would also be entitled to set up interoperable digital tools or IT infrastructures supporting the objectives of the Single Market Emergency Instrument Regulation, which could, where relevant for a specific future crisis, be useful also for purposes similar to those of the EU Digital COVID Certificate. The legislative procedure on the Commission’s proposal is currently ongoing and the envisaged framework therefore not yet available.
Lastly, given the global success of the technology underpinning the EU Digital COVID Certificate, the Commission and Member States are reflecting if and how such a technical architecture could potentially be used for use-cases other than the facilitation of free movement within the EU, including to facilitate travel to and from third countries. The technology could also be considered, for example, for the authentication of documents in the health domain and for further developing usability and security of cross-border digital health services (such as, for example, vaccination cards for the purposes of continuity of care, access to and dispensation of electronic prescriptions, access to patient summaries, etc.). Such other use-cases could support citizens seeking or receiving healthcare in a Member State other than their own. To ensure synergies, the potential implementation of such use-cases could be explored in the context of the development of the European Health Data Space. Supporting initiatives to foster the digital interoperability of health certificates at a more global level could also be considered. EU-level support for any such use-cases will depend, among other things, on whether or not there is an EU competence to act in the area concerned. In addition, the Commission underlines that any such use-cases must not result in restrictions to EU citizens’ exercise of their right to free movement.
3.Conclusion
With more than two billion certificates issued, the EU Digital COVID Certificate has delivered tangible benefits for EU citizens: it has facilitated free movement when travel restrictions were still deemed necessary, and, at the same time, it has allowed for a coordinated lifting of these restrictions once possible. In addition, the EU Digital COVID Certificate has been easy to use, free of charge and versatile to adapt to new developments. Finally, the EU Digital COVID Certificate framework has also established a standard in Europe and best practice at global level, with 76 countries and territories being connected to the system.
Without the EU Digital COVID Certificate, EU citizens would not have enjoyed a right to be issued interoperable vaccination, test or recovery certificate, and have them accepted by other Member States for the purposes of exercising their fundamental right to free movement. It has demonstrated the capacity of EU institutions and Member States to develop innovative solutions in record time, with key EU values such as data protection and open access guaranteed.
For reasons of epidemiological vigilance, it remains prudent to maintain the EU Digital COVID Certificate system during the 2022-23 winter period. The Commission will continue to follow closely the development of the epidemiological situation, and in particular the key elements that will be, according to ECDC, particularly decisive for the timing and magnitude of future COVID-19 waves. On this basis, the Commission will re-assess the situation by the end of March 2023 and decide whether to propose a further extension, or whether to have the Regulation expire in June 2023.
Being able to move between Member States using just one’s passport or identity card is one of the fundamental achievements of European integration. Any limitations to that right, including when they result from unprecedented events such as a global pandemic, must remain limited to what is strictly necessary. Ultimately, the EU Digital COVID Certificate Regulation will be a victim of its own success: its expiry will be proof that its declared aim, the restoration of unrestricted free movement, has been achieved.