Otherwise, some personal data will be required, since the person checking your code (like a bouncer) must be able to verify that against your ID card.
The bouncer at the night club don't need to know how many doses you had or where you tested negative, as that has no impact by the legislation
In addition to that, legislation may change, so your time limits and dosage limits now all change and future vaccinations might require more doses.
Either way, the bouncer doesn't get to see any of this. They only see your name, check your ID if it's the same name (which they have to do anyway to check you're 16 for alcoholic beverages and curfew) and then wave you through. The apps I've seen in use by people who check the vaccination QR code only give you an OK or NOT OK signal, once you've setup the type of limits you have to obey.
They could've gone the lazy route and stored your SSN (or similar).
In my country they expire after 10 years, on the birthday. So about 7 / (365 * 10) = 0.002 % of id cards expired this week here, or 115k cards. I'd store only the name and birthday and let officers check the id card with the usual procedure.
Linking to an ID card number has the slight advantage that the ID card number is unique whereas several people can have the same name and date of birth. It doesn't really help with keeping the name or date of birth private because in practice those things are printed on the ID card which has to be shown together with the QR code.
The ideal would be to reveal only the information that is needed in a particular situation. For example, if you're trying to get into an Austrian pub all that's needed is the photograph of the face and confirmation that the person with that face is over 18 and vaccinated. Though in practice people like pub bouncers are not very good at checking faces so having a physical ID card that is hard to counterfeit is an important part of the security.
That line of reasoning suggests that what's needed is an ID card with banknote-style anti-counterfeiting measures that shows only a unique number and a photograph while all other information is provided through another channel such as a QR code.
> It would presumably not be a problem for people to regenerate their QR code when they replace their ID card. They have to regenerate it every day or so anyway. (The QR code in the article expires after 48 hours.)
A not small number of those 115k people per week are elders without a smartphone or no digital abilities except video calling their children and nephews.
Luckily it seems that in my country we'll be able to get a permanent QR code (paper or plastic, don't know.) I'm thinking about getting that one instead of the digital certificate: one less app, no worries about batteries and if it worked for my passport, id card and driver license it will be OK for my covid pass too.
If you cannot hide 'name', because you need that for identification, you could hide 'vaccination details', for example by linking 'name' to 'is properly vaccinated?'. No need to specify what vaccin gotten where and when in how many doses. The signed-certificate part could still be present, as a tampering protection.
This very likely is a subjective matter. I absolutely would want my name to be associated to my vaccination details, and will certainly do when it will be my turn to get the shot (still have high antibodies level after catching symptomatic Covid months ago).
The part I am worried about is, do I want to give anybody and everybody access to this information, or only a select group which is in my control.
Do I want to share my full Google/Facebook account, with password, with everybody that I show a QR-code to (for example a 'Login with Facebook' button), or do I want to be selective and only allow for 'verify and give permission to access part of profile'?
Do I want to share my full contacts list with a random app I installed from an app store, just because I started it? Or do I want to be selective and deny 'access to contacts' for a game which has no business looking through my contacts.
0: (I beat symptomatic Covid at home, then tested negative, then after 3 weeks had a road accident and the mandatory ER triage swab told I was positive again, although this time with no symptoms).