COMMUNICATION FROM THE COMMISSION

Reaping the full benefits of EU Digital COVID Certificates:

Supporting free movement of citizens and the recovery of the air transport sector through guidelines and recommendations for EU Member States

(2021/C 313/02)

1.   Introduction

The EU Digital COVID Certificate (1) (‘EU DCC’) has entered into application across all Member States of the European Union on 1 July 2021. An EU digital system has successfully been rolled-out to issue, verify and accept certificates providing proof of vaccination, a negative SARS-COV-2 test result or recovery from COVID-19, free of charge. Collectively, the European Commission, the European Parliament and the Council, and national authorities have built from scratch a system to help restoring free movement within the Union and have successfully made it operational in record time. Together with the successful vaccination campaign, which marks a milestone in the fight against the pandemic, the EU DCC will have a significant positive impact on the daily lives of EU citizens and residents. This is complemented by other initiatives helping citizens to exercise their right to free movement such as the common approach to COVID-19 free movement restrictions agreed in Council Recommendation (EU) 2020/1475 (2) and the weekly traffic-light map published by the European Centre for Disease Prevention and Control it establishes (3), the ‘Re-Open EU information platform’ (4), and the European Tourism COVID-19 Safety Seal label for tourism establishments (5).

Barely four months have passed between the presentation of the legislative proposal by the European Commission to the operationalisation of the EU DCC – displaying once again the real added value of European cooperation. This has been made possible thanks to the commitment and dedication of the EU legislators and technical experts at European and national levels, in every Member State, as well as in the industry. The uptake of the EU DCC is setting new records too: more than 270 million digital certificates have already been issued, demonstrating the strong interest in using the EU DCC. The certificates are already interoperable in more than 30 countries. The overarching objective of facilitating the exercise of the right to free movement within the Union during the COVID-19 pandemic, established in the EU DCC Regulations, is much closer to being achieved thanks to the operationalisation of the EU DCC.

The EU DCC comes at a time when almost two thirds of the Union’s adult population have received at least one dose of a COVID-19 vaccine, and the Union has received enough vaccine doses to achieve its target to vaccinate fully at least 70 % of the adult population before the end of the summer 2021.

Air travel is one of the first large-scale use cases of the EU DCC. By early July 2021, air traffic had increased by 20 %, expected to reach more than 60 % of 2019 traffic levels for the month of July. (6) Air traffic volumes are continuing to ramp up progressively over the summer as EU citizens and residents seek to enjoy again their freedom of movement – whether for holiday, visiting friends and relatives, or professionally. The travel and tourism sectors are expected to benefit greatly from the uptake of the EU DCC. The rapidly growing air travel is testimony to the potential of the EU DCC to strengthen recovery whilst keeping the pandemic under control. At the same time, higher air passenger numbers require all actors involved to ensure a seamless implementation, notably of the verification of certificates. As set out below, a Commission survey has shown that there are currently 15 different combinations of EU DCC verification, some of which appear to involve avoidable duplication. As stated in the EASA/ECDC COVID-19 Aviation Health Safety Protocol, if verification has been reliably completed prior to departure, there is no medical reason for additional checks of the same certificate later on through the journey. A coordinated approach would help avert potential stress on air transport systems and allow delivering the full benefits of the EU DCC in terms of both health policy and the convenience and health of individual travellers.

Air travel to and from third countries still remains low. Although the EU DCC was mainly developed to facilitate travelling within the Union, it has the potential to become the global standard facilitating international travel. From the outset, the system was designed as an open source solution to contribute to the joint fight against the pandemic.

All partners in the European Economic Area (EEA) and Switzerland are already integrated in the EU DCC system. (7) As provided for in the Regulation, the Commission is also actively engaged in multilateral work on digital certificates, notably with the International Civil Aviation Organization (ICAO) and the World Health Organization (WHO), to ensure high standards and interoperability. Beyond that, many international partners have approached the EU bilaterally to learn about the EU DCC system. All technical specifications are publicly available (8) and the European Commission is already working with interested international partners wishing to roll out a secure verification system for digital COVID-19 certificates and to use the EU DCC system.

2.   Verification of the EU DCC in the air travel context

The EU Digital COVID Certificate aims to facilitate the holders’ exercise of their right to free movement (9) during the COVID-19 pandemic. It provides Member States with a reliable tool to verify compliance with restrictions of free movement put in place in response to the COVID-19 pandemic (10).

Secure verification is a key element offered by the EU DCC. EU Member States are, within the framework established by Regulation (EU) 2021/953 (11), deciding if, when and how, EU DCCs are to be verified. A coordinated approach could contribute to streamlining this process. EU Member States are performing such verification in a number of different ways in order to implement certain public health measures such as entry requirements for cross-border travel. Article 3(9) of Regulation (EU) 2021/953 establishes that cross-border transport service operators that have been designated to verify shall ensure that the verification of the EU DCC is integrated into the operation of cross-border transport infrastructure such as airports, ports and railway and bus stations, where appropriate.

It is of paramount importance that Member States swiftly inform citizens and operators about measures taken to lift or introduce restrictions to travel. The Member States in the eHealth Network, supported by the Commission, agreed on a set of Guidelines (12) to codify for validation rules that would significantly help in the verification process.

Along with the requirement of fulfilling Passenger Locator Forms (PLF) introduced by EU Member States, the digital verification of digital certificates is intended to avoid bottlenecks, thereby reducing possible crowding and queuing times at airports, especially at peak times. Crowding should be avoided to reduce the risk of potential COVID-19 infections. The specific way and timing of verification will have an impact on the extent to which bottlenecks are avoided. So far, airports and airlines have taken steps to process the increasing passenger flow, for example by reopening terminals that were closed and by increasing the number of staff at airline check-ins or information desks. This has helped to manage the first increase of passenger numbers but risks falling short of the capacity needs to be expected later during the summer of 2021. Airports that were already congested back in 2019 are likely to reach their capacity limit at 50 %-60 % of 2019 traffic levels. While the situation has not yet led to important congestion, already in early July 2021 EU airports are operating with about 45 % of the passenger traffic volumes compared to 2019. A smooth passenger experience without disruptions will allow operators to cope with an increase in air passenger traffic in the coming weeks.

In some EU Member States, airline operators are verifying EU Digital COVID Certificates, making it important that they are provided with the necessary verification software. According to a recent survey of the Airports Council International Europe (ACI Europe), the main issues encountered by operators are the multiplication of controls (64 %) and the verification at airport premises (54 %). In the same survey, 82 % of operators declared that the EU Digital COVID Certificates are not verified off-airport prior to departure (13). In some EU Member States, certain rules continue to differ from otherwise EU wide-adopted e-Health Network guidelines.

A survey among the EU Member States on how the EU DCC is verified for air travel revealed that there are currently 15 different ways of organising the verification process. Some EU Member States have, for example, decided to pass on the responsibility to verify the EU DCC to airports, while others have placed this obligation on airlines, and some on both. Many EU Member States have also opted for public authorities to verify the EU DCC of arriving passengers. While the EU DCC has been developed inter alia as a tool to facilitate travel without obstacles, notably within the Schengen area, it is important to underline that, the EU DCC is neither a travel document nor a pre-requisite for travel (14).

The EU single aviation market needs the EU DCC as a tool to cope with the increased passenger flows over the summer months in 2021 and during the recovery. After the collective success of operationalising the EU DCC, the next step must be to further facilitate safe and seamless travel during the pandemic.

The European Commission services published operational recommendations in an information note titled ‘Making the most of the EU Digital COVID Certificates in aviation: Recommendations and guidance for Member States’ (15) on 28 June 2021. On 30 June 2021, the e-Health Network, composed of national health experts, adopted a guidance document (16) laying down technical and operational elements for using EU DCCs in air travel. The document presents several options for verification, which are both legally (from an EU data protection perspective, in full compliance with the EU GDPR (17)) and technically possible.

This Communication seeks to provide overarching principles, best practices, recommendations and guidance for EU Member States to facilitate the verification of EU DCCs in aviation as we enter the peak summer travel season and beyond. This will be most relevant in the first instance for air travel but should be gradually taken up by other transport modes (e.g. ferries, cruise ships, rail and road transport), where this is possible and while taking into account their specificities.

3.   Recommended approach

This section sets out a series of guidelines and recommendations, which are addressed to EU Member States. Airlines and airports, as the closest interface with the passenger, will also have an important role and responsibility for delivering the full benefits of the EU DCC in aviation.

Regulation 2021/953 specifies that without prejudice to EU Member States’ competence to impose restrictions on grounds of public health, where EU Member States accept EU DCC, they shall refrain from imposing additional restrictions to free movement, such as additional travel-related testing for SARS-CoV-2 infection or travel-related quarantine or self-isolation, unless they are necessary and proportionate for the purpose of safeguarding public health in response to the COVID-19 pandemic, also taking into account available scientific evidence, including epidemiological data published by the ECDC on the basis of Recommendation (EU) 2020/1475. Recommendation 2020/1475 specifies that when adopting and applying restrictions to free movement, EU Member States should respect principles of EU law, in particular proportionality and non-discrimination and they should act in a coordinated manner.

In order to facilitate clarity for passengers and ensure a seamless travel experience without disruptions, all agents in the verification process need to be fully aware of their role and required actions. For the smooth implementation of EU DCC, it is essential that all EU Member States provide relevant stakeholders and the general public with clear, comprehensive and timely information about any restrictions to free movement. EU Member States should ensure that the information published on the Re-Open EU website is complete, up to date, and easy to understand, both with regard to EU Member States and third countries.

Member States should also update and publish the applicable validation rules in full transparency. The rules should be published on the EU DCC Gateway, which supports this functionality and distributes information to verifier and wallet apps. In addition, the rules should be made available on Re-Open EU. For transparency purposes, the rules should clearly include all the relevant information, such as the lists of vaccines for which certificates are accepted. The information currently published by Member States is not always clear for passengers.

EU Member States should ensure that airlines, airport staff or other agents empowered to verify EU DCCs are fully informed about their relevant roles and required actions. This information should also be made publicly available so that passengers are informed of the points at which they can expect relevant checks.

—	Recommendation 1: EU Member States should ensure complete, comprehensible and timely provision of information to operators and travellers about the verification requirements and processes.

—	Recommendation 2: EU Member States should ensure that the information published on the Re-Open EU website is complete, up to date, and easy to understand.

The development of interoperable EU DCCs marks an unprecedented step to prevent a patchwork of individual digital certificates based on different technical specifications in each EU Member State. EU Member States, via the e-Health Network, have approved a guidance document on validation rules for EU DCC to enable not only the verification of the authenticity of the certificate but also its compliance with corresponding travel rules. When airline or airport operators are required to check EU DCCs, EU Member States should publish and maintain updated validation rules. While there must be a possibility of presenting the EU DCC in person at the airport of departure and performing manual verification against the applicable business rules, operators and authorities should support electronic business rules verification processes. This will speed up the verification processes.

—	Recommendation 3: EU Member States should integrate the applicable travel rules in the verification processes and make available to operators a verification application that verifies the respective rules in accordance with the guidelines on validation rules agreed by the eHealth Network (18).

—	Recommendation 4: EU Member States should make available and keep the travel validation rules always up-to-date at the EU DCC Gateway.

—	Recommendation 5: EU Member States should use, where possible, electronic means of verification in accordance with the relevant eHealth Network guidelines

The EU DCCs are built on a trust framework agreed, set up and maintained by the Commission and by the Member States, in line with the applicable rules laid down in Regulation (EU) 2021/953. This trust framework ensures the reliable and secure issuance and verification of the certificates. As stated in the EASA/ECDC COVID-19 Aviation Health Safety Protocol (19), if verification has been reliably completed prior to departure, there is little justification from an epidemiological point of view for additional checks of the same certificate later on through the journey. Such duplication should be avoided. Member States should therefore verify the EU DCC with priority before departure. From a health safety point of view, this would also help reduce the risk that sick passengers travel. Verification upon arrival could be conducted on a risk-based approach.

To avoid duplication of checks by more than one actor (e.g. by airline operators and public authorities), ‘one-stop’ arrangements at departure should be implemented as much as possible between authorities, airports and airlines. EU Member States should therefore avoid requiring the verification of EU DCCs at more than one occasion during the air travel journey (e.g. during the airport check-in and again at boarding). It is worth noting that any requirement for verification of certificates established by Regulation (EU) 2021/953 does not as such justify the temporary reintroduction of border control at internal borders.

According to the above-mentioned EASA/ECDC COVID-19 Aviation Health Safety Protocol, from a medical perspective, the most effective option is to verify the EU DCC prior to arriving at the departure airport. However, currently 82 % of airport operators report that EU DCCs are not verified off-airport prior to departure (20). EU Member States and transport service operators are strongly encouraged to ensure that verification is carried out as early as possible, preferably during the online check-in process of an airline or via an EU Member State web portal/service, provided this is done in accordance with Article 4(2) of Regulation EU 2021/953.

When the Member State of arrival waives certain health related travel restrictions for travellers in possession of an EU DCC or other proof, the Member State of departure should ensure that all passengers have presented their EU DCCs prior to boarding the plane. While off-airport checks should always be preferred, certificates of all passengers who did not present them off-airport should be checked at the departure airport in such cases. Where checks are made at airports, resources should be deployed that are commensurate to the amount of checks to ensure smooth passenger flows at all times.

Cooperation between Member States and transport service operators is essential to deliver on these solutions, which require further work to ensure they are based on tested solutions. This would ensure that the positive effects of the EU DCC on the convenience and the flow of passengers are not undermined by the verification process at the airport, limiting the potential health safety risk. However, in the view of the eHealth Network, this option ‘might require extensive development and testing time, which could lead to an implementation after the summer of 2021’ (21).

EU DCC and data protection The trust framework of the EU DCC ensures the highest level of data protection, in line with Regulation (EU) 2016/679 of the European Parliament and of the Council (22) (‘GDPR’). Transport operators, such as airlines, are permitted to process the information necessary to comply with the verification obligations established by the applicable national law provided they do not retain any of the personal data present in the QR codes as expressly stated in the Regulation. This means that the legal basis necessary to allow airlines to verify EU DCCs already applies during the process of an online check-in, which can avoid bottlenecks and crowding at airports.

—	Recommendation 6: EU Member States should ensure that the EU DCC verification is carried out as early as possible and preferably before the passenger arrives at the departure airport.

—	Recommendation 7: EU Member States should make sure operators are empowered to verify EU DCC, and that they cooperate with airlines to facilitate integration of the verification process in check-in procedures in accordance with the provisions of the EU DCC Regulation.

Travel-related measures, such as the Passenger Locator Form (PLF) or the EU DCC, are complementary tools intended to support the safe resumption of travel activities while enhancing the contact tracing capabilities of EU Member States and reducing transmission risks. Ideally, they would cause as little inconvenience as possible to the travellers and their travel experience. The collection of the PLF, like the verification of the EU DCC, should be done also as early as possible and preferably before the passenger arrives at the departure airport to avoid multiple procedures for passengers.

Possible scenarios Before arriving at the departure airport, two possible scenarios of EU DCC verification could be considered: 1) Verification during the airline online check-in: This use case has the operational advantages of checking passenger health-related documents at one place and before arriving to the departure airport and does not require overly complex technical implementation. In addition, it should be recalled that Regulation (EU) 2021/953 as well as the GDPR allows transport operators to process health data as long as there is no storage provided that such use case is laid down by national law. 2) Verification of travel documents through specific applications and a web service developed in accordance with Regulation (EU) 2021/953. In this scenario, the combination of the verification of the EU DCC with the Passenger Locator Form of the Member State (in a digital format) and other health measures/requirements could be envisaged. This use case would also have the advantage of checking passenger health documents at one place and before arriving to the departure airport. As the second solution above is not available in most Member States and requires development and testing time, the Member States and the Commission should cooperate with a view to an implementation as soon as possible after the summer of 2021 (see Section 6.1 of the eHealth Network guidance ‘Validation of EU Digital COVID Certificate in the context of air transport’) (23).

—

Recommendation 8: EU Member States should work towards better coordination of PLF and EU DCC verification. EU Member States should ensure close cooperation with transport service operators to allow the verification the EU DCCs at the same time as the collection of other travel-related information, such as the PLF.

—	Recommendation 9: EU Member States should work towards solutions that can support the verification of EU DCC and collection of PLF data with a target to introduce this feature in the autumn this year.

4.   Conclusion

The rapid development and operationalisation of the EU DCC mark a milestone and key contribution to the fight against the pandemic. It effectively demonstrates how Europe can deliver concrete results in record time that have a positive impact on the lives of hundreds of millions of EU citizens, residents and visitors. The EU DCC supports the restoration of free movement in Europe whilst maintaining a high level of pandemic control, thanks to its reliability and ease of use, and is a key element in re-launching the travel and tourism sectors, which have been among the hardest hit by the pandemic. With the EU DCC, the European Commission, the European Parliament and Council, and EU Member States have collectively mobilised and undertaken huge efforts to develop the necessary tool to make this happen in time for the summer 2021 travel season. Further efforts are being deployed to extend the recognition of the EU DCC and similar health credentials to and from third countries, as a basis for re-opening reciprocal international travel where the epidemiological situation allows it.

The harmonisation and digitalisation of verification protocols is key to delivering a seamless experience to the European travelling public. The guidance and overarching principles of this Communication intend to contribute to a smooth travel experience. The Commission calls on the Member States and all actors involved in the air transport ecosystem to work together towards a better coordinated implementation of the EU DCC on the basis of the recommendations outlined in this Communication. This recommended approach for aviation could be gradually taken up also by other transport modes.

---

(1)  Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (OJ L 211, 15.6.2021, p. 1), and Regulation (EU) 2021/954 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) with regard to third-country nationals legally staying or residing in the territories of Member States during the COVID-19 pandemic (OJ L 211, 15.6.2021, p. 24).

(2)  Council Recommendation (EU) 2020/1475 of 13 October 2020 on a coordinated approach to the restriction of free movement in response to the COVID-19 pandemic (OJ L 337, 14.10.2020, p. 3).

(3)  https://www.ecdc.europa.eu/en/covid-19/situation-updates/weekly-maps-coordinated-restriction-free-movement

(4)  https://reopen.europa.eu/

(5)  https://ec.europa.eu/growth/content/new-european-tourism-covid-19-safety-seal-available_en

(6)  Eurocontrol, daily traffic variation, Network Manager Area, 8 July 2021 (https://www.eurocontrol.int/Economics/DailyTrafficVariation-States.html?ectl-public).

(7)  COVID-19 vaccination, test and recovery certificates issued by Switzerland in accordance with the Swiss COVID-19 Certificate Order are already treated as equivalent to those issued in accordance with Regulation (EU) 2021/953, according to Commission Implementing Decision (EU) 2021/1126 of 8 July 2021 establishing the equivalence of COVID-19 certificates issued by Switzerland to the certificates issued in accordance with Regulation (EU) 2021/953 of the European Parliament and of the Council (OJ L 243, 9.7.2021, p. 49).

(8)  EU Digital COVID Certificate specifications covering data structure and encoding mechanisms, including the QR code, which ensures that all certificates, whether digital or on paper, can be read and verified are available at https://ec.europa.eu/health/ehealth/covid-19_en

(9)  As established by Article 21 of the Treaty on the Functioning of the European Union and implemented by Directive 2004/38/EC.

(10)  Recital 6 of Regulation (EU) 2021/953.

(11)  According to Article 10(3) of Regulation (EU) 2021/953, the personal data included in the EU Digital COVID Certificates is to be processed by the competent authorities of the Member State of destination or transit, or by the cross-border passenger transport services operators required by national law to implement certain public health measures during the COVID-19 pandemic, only to verify and confirm the holder’s vaccination, test result or recovery. To that end, the personal data shall be limited to what is strictly necessary. The personal data accessed pursuant to this paragraph shall not be retained. According to Recital 30 of the Regulation, where Union citizens or their family members are not in possession of a vaccination certificate that complies with the requirements of the Regulation, they should be given every reasonable opportunity to prove by other means that they should benefit from the waiving of relevant restrictions to free movement afforded by a Member State to holders of vaccination certificates.

(12)  https://ec.europa.eu/health/sites/default/files/ehealth/docs/eu-dcc_validation-rules_en.pdf

(13)  Based on 27 operators, 92 airports across 19 European countries (Austria, Belgium, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Netherlands, Poland, Portugal, Romania, Spain, Sweden, Switzerland). These airports represent 58 % of the total number of passengers in the EU+EEA+CH area

(14)  The EU DCC aims to facilitate the exercise of the right to move and reside freely within the territory of the Member States by establishing a binding and directly applicable common framework in all Member States. This common framework should contribute to facilitating the gradual lifting of restrictions to free movement put in place by the Member States, in accordance with Union law, to limit the spread of SARS-CoV-2, in a coordinated manner. In any event, according to point 12 of Council recommendation 2020/1475, Member States should not restrict the free movement of persons travelling to or from another Member State’s areas classified as ‘green’. Therefore, they should not be required to present an EU DCC.

(15)  https://ec.europa.eu/transport/modes/air/news/2021-06-28-eu-digital-covid-certificates-in-aviation_en

(16)  https://ec.europa.eu/health/sites/default/files/ehealth/docs/covid-certificate_air-transport_en.pdf

(17)  General Data Protection Regulation (EU) 2016/679 (GDPR).

(18)  https://ec.europa.eu/health/sites/default/files/ehealth/docs/eu-dcc_validation-rules_en.pdf

(19)  EASA/ECDC COVID-19 Aviation Health Safety Protocol: Operational Guidelines for the management of air passengers and aviation personnel in relation to the COVID-19 pandemic, dated 17 June 2021, available at https://www.easa.europa.eu/sites/default/files/dfu/Joint%20EASA-ECDC%20Aviation%20Health%20Safety%20Protocol%20issue%203.pdf

(20)  ACI Europe, Survey on Digital COVID Certificates Implementation, 8 July 2021.

(21)  See Section 6.1 of the eHealth Network, ‘Guidelines on Validation of EU Digital COVID Certificates in the context of air transport’, 30 June 2021

(22)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(23)  eHealth Network, ‘Guidelines on Validation of EU Digital COVID Certificates in the context of air transport’, 30 June 2021.