If the answer is that a service can validate the data, then why not just have the ID value if its all going to be on a server?
Even ignoring that though: including both the ID and detail allows it to work both ways. In official situations (e.g. at a country border) you might be able to validate against a server, but the local nightclub probably doesn't have access to a validation server.
So the local nightclub cann't(legally) check these certificates.
This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records
Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects
So, if my interpretation is right, a national law backing those "secondary" uses must be in place.
Only health inspectors can do so, and they do random checks. Honestly, I don't know how this will end, because people are really fed up with this situation and all the lies from the government, and a club full of drunk people vs a few inspectors won't end well.
If I understand correctly, one of the pandemic laws requires them to verify, but the Information Commissioner's Office has countered that with one of their classic "well yes, but actually no" opinions saying that they're not actually allowed to demand that kind of information. What "demand" means here, of course, doesn't seem to be defined well, so I'm guessing they're still allowed to refuse service if you don't show them some proof.
Or maybe all of that has changed in the 20h since I was last at a bar - the speed at which the current government is making seemingly entirely random changes to the covid rules is genuinely impressive.
For example here in Italy I need the green pass to go to a wedding next week
And yes, in theory at least the name should be crosschecked with a form of ID. It's just a digital copy of a legal document, you could easily borrow or copy the paper version from someone else as well.
Some even sold screenshots on Facebook.
Now the app have all sorts of cool colour effects when you tilt your phone.
It's not clear (to me) when you are supposed to show the code with additional information, and I haven't been asked to do so.
The option with more data is only for official situations, like border control. That version is also in English and French.
1. No personal information at all. It only says valid or not valid. 2. Name and date of birth 3. Foreign travel, with name, date of birth as well as information about test type or vaccination type etc.
So no, due to privacy, there no nane show by default.
The QR codes design is pretty sound, so as long as they are validated correctly and checked against an ID this should not be possible.
You can run the text through a translator yourself, but the main quote: "Henover weekenden har vi allerede set de første eksempler på danskere, der sælger QR-koder i lukkede grupper på sociale medier" roughly translates to: "During the weekend we have experienced the first examples of people selling QR codes in closed groups on social media".
Edit: This article [2] is about 6 teens being charged with forgery of the pass.
[1]: https://www.inputmag.dk/snyd-med-coronapas-er-dokumentfalsk/
[2]: https://www.dr.dk/nyheder/regionale/oestjylland/seks-gymnasi...
Notably, it contains my full name, including middle name, and date of birth.
It notably states that it's only valid together with an identification document.
It's possible, of course, that gyms and nightclubs don't check very thoroughly, but I certainly wouldn't risk passing a border with a fake certificate.
Any information on the users phone can 100% not be trusted. It should just show the QR code. On the other hand the scanning App has to validate the signature, check if the dates are correct and display a big info that the QR is only valid if the name is the same as the one on a presented ID.
Maybe this should have been a design requirement from the EU spec.
I'm not entirely sure that the people implementing the policies understand the 'herd immunity' model, nor the by now fairly comprehensive statistical data on who is and isn't at significant risk from Covid19.[0]
Q: If a healthy 18 year-old chooses to attempt to go to a nightclub unvaccinated, who exactly is put at risk from this?
[0] https://www.ons.gov.uk/aboutus/transparencyandgovernance/fre...
"Children's risk of severe disease from Covid is tiny, deaths are extremely rare and have only occurred in UK children with profound underlying and life-limiting conditions. The direct benefits to them of vaccination would be low."[0]
Insert quote from Margaret Thatcher from 1987?[0]
More seriously, there is no [longer] one approved way to live, thank goodness.
We rightly demand that larger / mainstream groups respect minorities.
At what point is it OK to stop listening or respecting minority views, and who gets to decide that?
[0] "you know, there's no such thing as society. There are individual men and women and there are families" https://www.theguardian.com/politics/2013/apr/08/margaret-th...
I would even take a vaccine to protect some abstract person with a broken immune system whom I never met and probably never will.
I would even do that if the vaccine wouldn't help me (which it does).
It is called empathy and caring for each other.
That person, plus every person they come in contact with.
Oh, you can compute the total "risk" of course. Assuming the person is contaminated and you put their personal "risk" treshold at an arbitrary 2% (which I just pulled out of thin air: chance of getting unacceptable side-effects: p(side_effect|contaminated)). You then have to sum that up for every person they come in contact with.
sum((1-vacc_effectiveness)*personal_risk*transmissiveness).
The real contribution might be even greater than that, as the contaminated will go on carry the virus to other people.
In theory if the number of people is large enough, you should be able to replace the values with average ones, but it's likely that 18 yo will spend more time with 18 yo than 70 yo.
To sum it up, herd immunity only works if enough people are immune (vaccinated). Everyone should feel responsible for it, even 18 years-olds (unless you take a very individualist view of life, which seems like a dominant feeling in the US: it works a lot like the prisoner's dilemna). Anyway, I'm just proud of performing my civic duty, I won't be a carrier for that virus.
There are a considerable number of people out there - some of whom are young and healthy and at vanishingly small personal risk from Covid19 - who if you mention the phrase "unacceptable side-effects" their first thought would be of side effects from vaccination, not the virus.
The boss at my daughter's kindergarten had Covid19 last summer. She had to quarantine for two weeks, then came back to work. She told me (unprompted) that sitting out the quarantine was way worse than the virus.
Telling these people they are stupid or anti-social - or simply downvoting them :) - may not be the most effective strategy to make them change their mind.
How should society approach this?
How should governments approach this?
So if over the course of their study period, 100 unvaccinated people got covid out of a thousand tracked, with a 98% effectiveness, only 2 people in the 1000 people vaccinated group would have gotten it.
So vaccines are really effective. Even more so for preventing serious complications.
It is is about the authority that delivers the QR code: if it doesn't have the data (photo) it can't produce the QR code.
For example, I have been vaccinated in April, long before the green pass appeared. No one took my picture at that time (and that's not the task of doctors to take pictures and store them in central database, for privacy reasons). I still deserves a QR-code to go out of home.
In France we have ID cards which can link a photo to the name and birth date. So encoding name and birth date in the QR-code are enough.
Border guards are even less interested in the validity of your covid certificates than nightclub bouncers. They have very limited amounts of time they can spend on processing people without the whole system collapsing
You will not enter any Schengen country without the border guard checking if you have an entry in the Schengen Information System.[1]
A reply is available within seconds after the border agent scans your ID document (passport or identification card).
Travelling between Schengen countries doesn't require an id or a passport, but currently countries have restrictions on entry most of them either insisting on you being vaccinated or to present a current Covid test.
I'm travelling to Paris by train on Friday. which has the following requirements for entry:
From 9 June, fully vaccinated people from EU or
Schengen Associated Countries will not be subject to
testing or isolation requirements.
Accepted vaccines:
Pfizer/BioNTech
Moderna
AstraZeneca
Johnson & Johnson (Janssen)
All travellers (from 9 June: all non-vaccinated
travellers) are subject to the requirement for a pre-
departure negative COVID-19 test taken within 72 hours
prior to arrival.
[1] https://ec.europa.eu/home-affairs/what-we-do/policies/border...
Why would it be dumb to use fake documents when it’s literally impossible to get caught?
I can safely discuss this on the internet too, it’s not like anyone took photocopies of the documents I showed them.
FWIW I’m not some antivaxxer nutjob, I’m happy to wear masks and self isolate when I’m sick. I’m just going to fight the surveillance state in any way I can.
> You will not enter any Schengen country without the border guard checking if you have an entry in the Schengen Information System.[1]
This is actually not correct. Many EU citizens do not have SIS entries but are still able to travel. This is likely to change in the future though.
Why would you do that? Unless you're pulling some dodgy shit there is really no reason for this and frankly, I don't believe you.
> Many EU citizens do not have SIS entries but are still able to travel.
Huh? Of course you don't have an entry in the SIS if there's no reason to be entered. SIS is not a directory about every resident in the Schengen area, let alone the whole world. If you do have an entry, however (dpending on its contents) you can be damn sure that you're in for an extended interview with border authorities.
Because I like to travel regardless of government restrictions? Is that “dodgy shit”?
I just brought a friend who is a Russian citizen to France with documents showing that she had a car booked to transfer her to Switzerland for surgery.
Right now anyone entering the UK from certain countries needs documents to show that they’re in “transit” to avoid quarantines.
> Huh? Of course you don't have an entry in the SIS if there's no reason to be entered
My bad, I misunderstood what you were saying.
Yes.
HTH!
Anecotal data point #1:
I've entered Italy three times [by road] in the last six months, each time with a sheaf of paperwork to hand demonstrating my need to travel, negative test, EU27 residency, the full nine yards.
During none of the three visits did I even see a border guard / police / Carabinieri / $whoever at or close to the border, never mind get stopped, never mind have my documents checked.
There is policy, and there is reality. Maybe the gap between them in Italy is marginally larger than in some other places?
The QR code by itself is not proof of anything until you have verified that it actually belongs to the person showing it. That's where the ID comes in.
We have the vacciness, anyone can get one for free, just open up, and let the antivaxxers risk it if they want.
Even with a vaccine you can get COVID. Any body hosting a COVID virus is an environment where mutations happen.
We don't just want people to stop dying from COVID. We also want to stop new more dangerous strains of the virus to emerge or propagate.
We do not implement these measures here (Germany) at the moment. Anyone can visit stores or e.g. retirement homes without having to show a negative test result or proof of vaccination. Before easing the measures, people with proof of vaccination were treated like having a negative result in general, i.e. they could do all the things that others also could but without the hassle of having to be tested.
If you are vaccinated, you just show your pass and go into the bar. If you aren't you have to produce a test. A recent test. So frequent renew. Or you might just not be allowed to get in.
So just get the vaccine and life will be easier.
If you don't want the vaccine, just stay at home.
But one of the main benefits of the GDPR is making it illegal for businesses to keep surveillance records on you. This way you don't have to worry about keeping basic information like your name secret in the first place.
The US really needs something like the GDPR to restore some societal trust. As it stands, I'm planning on wearing a mask into stores etc for as long as I can get away with it.
Yeah, but that's the US. Which is well known for being pretty wacky on these things.
> It's another avenue of obtaining identifying information about you, to abuse with no restrictions.
How? You hold up your vaccine pass to the bouncer, and your photo ID, so he can see that the vaccine pass is actually yours: He compares the face in the ID to yours, and the name on the pass to that on the ID. Then he turns away from you and says "Next, please". In two minutes he has forgotten your name, and in thirty he remembers your face to the extent that he can say "Yeah, I think I let that one in tonight."
Does he photograph your pass and ID, or type them into some computer system? Hardly. So what's to "abuse"?
> This way you don't have to worry about keeping basic information like your name secret in the first place.
In any sane society, your name isn't supposed to be a secret.
Dang, Americans are a funny people. Paranoid about all the wrong things.
[..] especially given that you can also cross a border with a negative antigen test, which is pretty easy to come by. I must have done getting on for 50 of them so far this year.
Any video for that?
ie. the patient would scan a qr code (containing a nonce) on the checkpoint, and include that number in the token which was then shown to the checkpoint.
On top of that, online verification (e.g. by certificate ID) might be possible, too.
It would be cool if the whole thing was signed by a government public key, then you could verify it offline.