COVID vaccination certificates – What does the QR code mean? Are they worth the paper they are printed on and how to get one on-line
Christine Betterton-Jones, knowledge junkie
The history of passports
Before we look at the global situation as regards international COVID vaccination certificates, it’s an idea to look back at the shambles which was once the status of international passports.
Info from: https://www.economist.com/international/why-vaccine-passports-are-causing-chaos/21805939
Before the first world war, few countries required passports. Then during and after the conflict, countries created bespoke travel documents to protect their borders. Different countries required and provided different types of information about their citizens.
In 1920, the League of Nations introduced a 32 page booklet with the country’s name on the cover and basic personal information such as place and date of birth. France thought the was booklet too expensive to print compared with its single sheet and took a few years to comply. But today all passports throughout the world follow the same format.
Covid Passports – status 2021
The same trajectory is being followed with the Covid Vaccination passport or certificate. Each country – or group of countries – is producing their own certificate with different types of personal information on it. Even though most have QR codes, these are not standardised and need special verifier apps to read them.
In the UK you can choose between :
- A QR code on the NHS app or website
- A letter of certification from your doctor
The QR code shows only a symbol – a tick or a cross
US:
- There is no national database
- There are different State and private health passes
- “CommonPass” (US) QR code shares raw data on vaccination status
In many countries, other countries’ QR codes cannot be verified – hence “Flash and Go” and fraud.
Verifiers just eyeball the certificates for confirmation that the bearer:
- has been vaccinated
- or tested and
- there’s a digital signature on the certificate from a trusted issuer
Some countries refuse to accept other countries’ certificates – e.g. UK will not accept India’s CoWin certificate, partially because there’s no precise date of birth (…Note: some regional governments in India only record the year of birth so there is no precise date of birth!)
You can easily buy fake certificates, which would pass the flash and go verification, though fail if scanned properly e.g.:
- French vaccine certificate €75
- Russian: $134
- Singaporean: €250
Ideally, an international body like the WHO should set the standards for a vaccination passport, but it has distanced itself from this massive task which is politically charged. Would you trust a certificate from Tajikistan?, do you trust the Sputnik vaccine?
Situation in Spain
So what about us here in Spain? Spain has joined the EU Digital Covid Certificate system which is detailed on the following site. We will soon need these certificates to enter restaurants, bars, concerts etc.
- The EU Digital COVID Certificate contains a QR code with a digital signature to protect it against falsification.
- When the certificate is checked, the QR code is scanned and the signature verified.
- Each issuing body (e.g. a hospital, a test centre, a health authority) has its own digital signature key. All of these are stored in a secure database in each country.
- The European Commission has built a gateway through which all certificate signatures can be verified across the EU.
- The personal data of the certificate holder does not pass through the gateway, as this is not necessary to verify the digital signature. The European Commission also helped Member States to develop national software and apps to issue, store and verify certificates and supported them in the necessary tests to on-board the gateway.
Non EU countries such as Switzerland, UK Norway and Turkey are part of this scheme. To date, there are 25 non-EU participating countries.
The system does its best to protect user privacy:
- The EU Digital COVID Certificate contains necessary key information such as name, date of birth, date of issuance, relevant information about vaccine/ test/recovery and a unique identifier. This data remains on the certificate and is not stored or retained when a certificate is verified in another Member State.
- The certificates will only include a limited set of information that is necessary. This cannot be retained by visited countries. For verification purposes, only the validity and authenticity of the certificate is checked by verifying who issued and signed it. All health data remains with the Member State that issued an EU Digital COVID Certificate.
How can I get my COVID certificate?
In Spain, regional health authorities are responsible.
Here in the Comunidad Valenciana go to
https://coronavirus.san.gva.es/es/web/vacunacion/inicio
From here you can :
- Download a vaccination voucher “Justificante Vacunal Covid-19”
This document just lists your vaccinations against Covid . It is not a legal document
- Update your contact information
- Obtain your EU Covid Certificate “Certificado COVID UE”, which is what you will need if you want to travel and gain access to restaurants, cinemas etc. Click on this button. Which will take you to this page.
From here you can also get (if applicable – scroll down to take a look) :
- Test certificate “Certificado de Diagnóstico”
Available if you have had a PCR for COVID in the last 72 hours or an antigen test 48 hours ago.
- Certificate proving you had Covid and have recovered “Certificado de Recuperación”
Available if you had been confirmed with COVID-19 by a positive PCR test less than 180 days ago. The European regulation does not admit a positive antigen test as a certificate of recovery.
All these require you to provide your SIP card number, date of birth and a mobile phone number which is identified as your contact mobile number on the website.
If you click on “Solicitar Certificado Covid Digital UE” you will be taken to the next page:
Insert your 7 digit SIP number, date of birth and (if it’s on the card) date the SIP card was issued. Then type the five symbol verification code into the box below it and click on Validar
You will be taken to another web page while an SMS message containing a six letter code will be sent to your phone. Copy or type this code into the box on the web page displayed and the digital certificate will be generated as a PDF file which you can download and print. It’s a good idea to store this on your phone and / or in the Cloud. e.g. Google drive, iCloud, Dropbox.
It looks like this:
Note: In addition to the Covid vaccination certificate, you may need a photo ID (e.g. TIE card, driving license) to enter a venue, since the vaccination certificate only bears your name and date of birth.
Special apps are needed to verify the QR codes on EU Covid certificates. The one recommended by the Comunidad Valenciana is: CovidCheck.lu which can be downloaded by everyone.
For Android: https://play.google.com/store/apps/details?id=lu.etat.ci.dcc.android&hl=en_US&gl=US
For Apple: https://apps.apple.com/lu/app/covidcheck-lu/id1570218766
Unfortunately, since it’s a piece of software written in Luxembourg it’s in French and English, but not in Spanish. Hopefully a Spanish language app will be available soon.