The personal data transferred pursuant to the legislation on the EU COVID digital certificate enjoys the protection conferred by regulation 2016/679 and, in particular, also by regulation 2021/953. Under EU law, this data is processed only for the purpose of accessing and verifying the information contained in the digital certificate, in order to facilitate the exercise of the right of free movement within the Union during the pandemic. The data will no longer be processed after the end of the period of application of the Regulation i.e. on 30.06.2022.
Personal data are processed by the relevant authorities of the member state of destination or transit, or by operators of cross-border passenger transport services that are required by national law to implement certain public health measures during the pandemic, and only for the purpose of verifying and confirming the vaccination, the results of tests, or recovering the data subject. For this purpose, the data must be limited to what is strictly necessary. The entity issuing the certificates may not keep that data longer than is strictly necessary for its purpose, and in no case longer than the period during which the certificates may be used to exercise the right of free movement. In turn, personal data accessed by the competent authorities of the Member State of destination or transit or by operators of cross-border passenger transport services may not be retained. This is the protection regime for personal data contained in digital passports conferred by European legislation.
