It was predictable. The Covid passport had been talked about for months. And the only thing missing was to start making it mandatory to restrict certain movements for those who did not have it available. Months ago the motivation for its use was to ensure a certain mobility of people across Europe, a bet to save the tourist summer. But it was little more than a border procedure. Little by little, several countries began to require it to access certain spaces. Now, at home, we already have the obligation to show it in nightlife, gyms, bars and restaurants. We are getting used to it, but not so long ago, displaying this sheet with data about our health status would have aroused discomfort, to say the least.
Going to a restaurant, for example, today is a constant check of Covid passports, or officially the European Union's Covid-19 Digital Certificate. It is routine now. However, we are accepting unconventional data processing. All the procedures that have been incorporated, fortunately for the protection of people's rights in terms of privacy with the implementation of the GDPR, are questioned with actions like this.
Let's leave aside the fact that without a passport, the problems begin. That is, without being vaccinated. Certainly, the common good of collective health can be considered as a higher purpose than each person's personal decision about when to get vaccinated or not. There have already been movements to reject the fact of limiting mobility to the unvaccinated, of not allowing attendance at the workplace... because seen in this way, not allowing access to indoor spaces even seems like something minor.
The point is that the general prevention rules imposed by the health authorities to deal with Covid-19 have priority. They have the necessary legal support -which has not always been the same in each autonomous community, neither in time nor in funds-. Therefore, it is legitimate to require this accreditation with personal information. Now, the obvious improvisation of how everything has been carried out is uncomfortable. For restaurant owners, for example, having to take responsibility for this data processing is an unexpected and unsought problem. We can reduce it to a procedure, a gesture with the QR code reader and that's it, but this is access control and a registration of attendees to a space that has the name of personal data processing in capital letters. To complete it, related to health data. And the user? Entering the wheel, we have accepted all of this because having to show our passport is vox populi, but we have forgotten about being properly informed and giving express, unequivocal, traceable, enforceable consent to any activity involving data management. And it could set a bad precedent.
