REGULATION (EU) 2021/… OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery to facilitate free movement during the COVID-19 pandemic (EU COVID-19 Certificate)

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 21(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) Every citizen of the Union has the right to move and reside freely within the territory of the Member States, subject to the limitations and conditions laid down in the Treaties and by the measures adopted to give effect to them. Directive 2004/38/EC of the European Parliament and of the Council (2) lays down detailed rules as regards the exercise of that right

(1a) Facilitating freedom of movement is one of the key preconditions for starting an economic recovery.

(2) On 30 January 2020, the Director-General of the World Health Organization (‘WHO’) declared a public health emergency of international concern over the global outbreak of severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), which causes coronavirus disease 2019 (COVID-19). On 11 March 2020, the WHO made the assessment that COVID-19 can be characterized as a pandemic.

(3) To limit the spread of the virus, the Member States have adopted various measures, some of which have had an impact on Union citizens’ right to move and reside freely within the territory of the Member States, such as restrictions on entry or requirements for cross-border travellers to undergo quarantine/self-isolation or a test for SARS-CoV-2 infection. Such restrictions have detrimental effects on citizens and businesses, especially cross-border workers and commuters or seasonal workers.

(4) On 13 October 2020, the Council adopted Council Recommendation (EU) 2020/1475 on a coordinated approach to the restriction of free movement in response to the COVID-19 pandemic (3). That Recommendation establishes a coordinated approach on the following key points: the application of common criteria and thresholds when deciding whether to introduce restrictions to free movement, a mapping of the risk of COVID-19 transmission based on an agreed colour code, and a coordinated approach as to the measures, if any, which may appropriately be applied to persons moving between areas, depending on the level of risk of transmission in those areas. In view of their specific situation, the Recommendation also emphasises that essential travellers, as listed in its point 19, and cross-border commuters, whose lives are particularly affected by such restrictions, in particular those exercising critical functions or essential for critical infrastructure, should ▌be exempted from travel restrictions linked to COVID-19.

(5) Using the criteria and thresholds established in Recommendation (EU) 2020/1475, the European Centre for Disease Prevention and Control (‘ECDC’) has been publishing, once a week, a map of Member States, broken down by regions, in order to support Member States’ decision-making (4).

(6) As emphasised by Recommendation (EU) 2020/1475, any restrictions to the free movement of persons within the Union put in place to limit the spread of COVID-19 should be based on specific and limited public interest grounds, namely the protection of public health. It is necessary for such limitations to be applied in compliance with the general principles of Union law, in particular proportionality and non-discrimination. Any measures taken should thus be strictly limited in scope and time in line with the effort to restore a fully functioning Schengen area without internal border controls and should not extend beyond what is strictly necessary to safeguard public health. Furthermore, they should be consistent with measures taken by the Union to ensure seamless free movement of goods and essential services across the Single Market, including those of medical supplies and medical and healthcare personnel through the so-called ‘Green Lane’ border crossings referred to in the Commission Communication on the implementation of the Green Lanes under the Guidelines for border management measures to protect health and ensure the availability of goods and essential services (5).

(7) People who are vaccinated, have a negative NAAT test that is less than [72 hours] old or have a negative rapid antigen test that is less than [24 hours] old, and people who have tested positive for specific antibodies to the spike protein within the last [6 months], have a significant reduced risk of infecting people with SARS-CoV-2, according to current medical knowledge. The free movement of persons who based on sound scientific evidence do not pose a significant risk to public health, for example because they are immune to and cannot transmit SARS-CoV-2, should not be restricted, as such restrictions would not be necessary to achieve the objective pursued.

(7a) To ensure harmonised use of the certificates, the duration of their respective validity should be set in this Regulation. However, at this stage, it is still unclear whether vaccines prevent transmission of COVID-19. Similarly, there is insufficient evidence on the duration of effective protection against COVID-19 following recovery from a prior infection. Therefore, it should be possible to adjust the duration of validity based on technical and scientific progress.

(8) Many Member States have launched or plan to launch initiatives to issue vaccination certificates. However, for these to be used effectively in a cross-border context when citizens exercise their free movement rights, such vaccination certificates need to be fully interoperable, compatible , secure and verifiable. A commonly agreed approach is required among Member States on the content, format, principles, technical standards and level of protection of such certificates.

(9) Unilateral measures in this area have the potential to cause significant disruptions to the exercise of free movement ▌, and to hinder the proper functioning of the internal market, including the tourism sector, as national authorities and passenger transport services, such as airlines, trains, coaches or ferries, are confronted with a wide array of diverging document formats, not only regarding a person’s vaccination status but also on tests and possible recovery from COVID-19. [Am. 8]

(9a) The European Parliament called in its resolution of 3 March 2021 on establishing an EU strategy for sustainable tourism for a harmonised approach across the EU on tourism, both implementing common criteria for safe travel, with an EU Health Safety protocol for testing and quarantine requirements and calling for a common vaccination certificate, once there is sufficient evidence that vaccinated persons do not transmit the virus, or mutual recognition of vaccination procedures.

(10) Without prejudice to the common measures on the crossing of internal borders by persons as laid down in the Schengen acquis, in particular in Regulation (EU) 2016/399 of the European Parliament and of the Council (6) , and for the purpose of facilitating the exercise of the right to move and reside ▌within the territory of the Member States, a common framework for the issuance, verification and acceptance of interoperable certificates on COVID-19 vaccination, testing and recovery ▌ entitled ‘ EU COVID-19 Certificate’ should be established which should be binding and directly applicable in all Member States. All Union transport hubs, such as airports, ports, railway and bus stations, where the certificate is being verified, should apply standardised and common criteria and procedures for the verification of the EU COVID-19 certificate on the basis of guidance developed by the Commission.

(10a) Member States, when applying this Regulation, should accept every type of certificate issued in accordance with this Regulation. The interoperable certificates should have equal value during the duration of their validity.

(11) This Regulation is intended to facilitate the application of the principles of proportionality and non-discrimination with regard to possible restrictions to free movement and other fundamental rights as a result of the COVID-19 pandemic, while pursuing a high level of public health protection and should not be understood as facilitating or encouraging the adoption of restrictions to free movement, or other fundamental rights, in response to the pandemic. ▌The exemptions to the restriction of free movement in response to the COVID-19 pandemic referred to in Recommendation (EU) 2020/1475 should continue to apply. Any need for verification of certificates established by this Regulation should not be able as such to justify the temporary reintroduction of border controls at internal borders. Checks at internal borders should remain a measure of last resort, subject to specific rules set out in Regulation (EU) 2016/399.

(12) The foundation of a common approach for the issuance, verification and acceptance of such interoperable certificates hinges upon trust. False COVID-19 certificates may pose a significant risk to public health. Authorities in one Member State need assurance that the information included in a certificate issued in another Member State is trustworthy, that it has not been forged, that it belongs to the person presenting it, and that anyone verifying this information only has access to the minimum amount of information necessary.

(13) The risk posed by false COVID-19 certificates is real. On 1 February 2021, Europol issued an Early Warning Notification on the illicit sales of false negative COVID-19 test certificates (7). Given the available and easily accessible technological means, such as high-resolution printers and various graphics editor software, fraudsters are able to produce high-quality forged, faked or counterfeit certificates. Cases of illicit sales of fraudulent test certificates have been reported, involving more organised forgery rings and individual opportunistic scammers selling false certificates offline and online.

(14) To ensure interoperability and equal access, including for vulnerable persons such as persons with disabilities and for persons with limited access to digital technologies, Member States should issue the certificates making up the EU COVID-19 Certificate in a digital or paper-based format , as chosen by the holder . This should allow the prospective holder to request and receive a paper copy of the certificate and/ or to store and display the certificate on a mobile device. The certificates should contain an interoperable, digitally readable barcode containing only the relevant data relating to the certificates. Member States should guarantee the authenticity, validity and integrity of the certificates by electronic seals ▌. The information on the certificate should also be included in human-readable format, either printed or displayed as plain text. The layout of the certificates should be easy to understand and ensure simplicity and user-friendliness. The information and layout should be presented in an accessible manner for persons with disabilities following the accessibility requirements for information, including digital information, laid down in Directive (EU) 2019/882 of the European Parliament and of the Council (8). To avoid obstacles to free movement, the certificates should be issued free of charge, and persons should have a right to have them issued. Member States should automatically issue the certificates making up the EU COVID-19 Certificate ▌, or in the case of the certificate of recovery only upon request, ensuring that they can be obtained easily and swiftly and providing, where needed, the necessary support to ensure for equal access by all persons . Any additional technical, digital and transport infrastructure expenses needed to put in place the vaccination certificates should be eligible under Union funds and programmes. [Am. 17]

(14a) The vaccines should be considered as global public goods available to the general population, hence Member States should ensure fair and free of charge access for all citizens. Member States should also ensure universal, accessible, timely and free of charge access to COVID-19 testing possibilities, including making these available in all transport hubs. Issuance of certificates pursuant to Article 3(1) should not lead to differential treatment and discrimination based on vaccination status or the possession of a specific certificate referred to in Articles 5, 6 and 7.

(15) The security, authenticity, integrity and validity of the certificates making up the EU COVID-19 Certificate and their compliance with Union data protection legislation are key to their acceptance in all Member States. It is therefore necessary to establish a trust framework laying out the rules on and infrastructure for the reliable and secure issuance and verification of certificates. The infrastructure should be developed, with a strong preference for the use of Union technology, to function on all electronic devices while ensuring that that infrastructure is protected from cybersecurity threats. The trust framework should ensure that the verification of a certificate can happen offline and without informing the issuer about the verification and should therefore ensure that no issuer of certificates, nor any other third party, is informed when a holder presents a certificate . The outline on the interoperability of health certificates (9) adopted, on 12 March 2021, by the eHealth Network set up under Article 14 of Directive 2011/24/EU (10) should form the basis for the trust framework. The trust framework should therefore be based on a public-key infrastructure with a trust chain from Member States’ health authorities to the individual entities issuing the certificates. The trust framework should allow for detection against fraud, in particular forgery. A separate independent certificate should be issued for each vaccination, test or recovery, and no history of the previous certificates of the holder should be stored on the certificate.

(16) Pursuant to this Regulation, any of the certificates making up the EU COVID-19 Certificate should be issued to persons as referred to in Article 3 of Directive 2004/38/EC, that is, Union citizens and their family members, including citizens from Overseas Countries and Territories as referred to in Article 355.2 Treaty on the functioning of European Union (TFEU), whatever their nationality, by the Member State of vaccination or test, or where the recovered person is located. Where relevant or appropriate, the certificates should be issued to another person on behalf of the vaccinated, tested or recovered person, for example to the legal guardian on behalf of legally incapacitated persons or to parents on behalf of their children. The certificates should not require legalisation or any other similar formalities.

(16a) Restrictions linked to cross-border travel are particularly disruptive for persons who cross them daily or frequently to go to work or school, visit close relatives, seek medical care, or to take care of loved ones. The EU COVID-19 Certificate should facilitate the free movement of border residents, seasonal cross-border workers, temporary cross-border workers and transport workers.

(16b) Underlining Recital (14a) of this Regulation and paragraphs 6 and 19 of Recommendation (EU) 2020/1475, Member States should pay particular attention to the specificities of cross-border regions, outermost regions, exclaves and geographically isolated areas and the need to cooperate at local and regional level as well as to persons who are considered to be frontier workers, cross-border workers and border residents and who reside in another Member State to which they return as a rule daily or at least once a week. [Am. 18]

(17) The certificates making up the EU COVID-19 Certificate could also be issued to nationals or residents of Andorra, Monaco, San Marino and the Vatican/Holy See ▌.

(18) ▌Agreements on free movement of persons concluded by the Union and its Member States, of the one part, and certain third countries, of the other part, provide for the possibility to restrict free movement for public health reasons. Where such an agreement does not contain a mechanism of incorporation of European Union acts, certificates issued to beneficiaries of such agreements should be accepted under the conditions laid down in this Regulation. This should be conditional on an implementing act to be adopted by the Commission establishing that such a third country issues certificates in accordance with this Regulation and has provided formal assurances that it would accept certificates issued by the Member States.

(19) Regulation (EU) 2021/XXXX applies to third-country nationals who do not fall within the scope of this Regulation and who reside or stay legally in the territory of a State to which that Regulation applies and who are entitled to travel to other States in accordance with Union law.

(20) The framework to be established for the purpose of this Regulation should seek to ensure coherence with global initiatives or similar initiatives with third countries with which the European Union has close partnerships , ▌involving the WHO and the International Civil Aviation Organisation . This should include, where possible, interoperability between technological systems established at global level and the systems established for the purpose of this Regulation to facilitate free movement within the Union, including through the participation in a public key infrastructure or the bilateral exchange of public keys. To facilitate the free movement rights of Union citizens vaccinated or tested by third countries or by Overseas Countries or Territories referred to in Article 355 (2) TFEU or listed in Annex II thereto or the Faroe Islands , this Regulation should provide for the acceptance of certificates issued by third countries or by Overseas Countries or Territories or the Faroe Islands to Union citizens and their family members where, the Commission finds that these certificates are issued according to standards equivalent to those established pursuant to this Regulation.

(21) For the purpose of facilitating free movement, and to ensure that restrictions of free movement currently in place during the COVID-19 pandemic can be lifted in a coordinated manner based on the latest scientific evidence and guidance made available by the Health Security Committee, ECDC and the European Medicines Agency (EMA), an interoperable vaccination certificate should be established. This vaccination certificate should serve to confirm that the holder has received a COVID-19 vaccine in a Member State and should allow for the waiving of travel restrictions . The certificate should contain only the necessary information to clearly identify the holder as well as the COVID-19 vaccine, number, date and place of vaccination. Member States should issue vaccination certificates for persons receiving vaccines that have been granted marketing authorisation pursuant to Regulation (EC) No 726/2004 of the European Parliament and of the Council (11) ▌.

(22) Persons who have been vaccinated before the date of application of this Regulation, including as part of a clinical trial, should also be entitled to obtain a certificate on COVID-19 vaccination that complies with this Regulation. At the same time, Member States should remain free to issue proofs of vaccination in other formats for other purposes, in particular for medical purposes.

(23) In line with the principle of non-discrimination, Member States should also issue such vaccination certificates to Union citizens and their family members who have been vaccinated with a COVID-19 vaccine having been granted market authorisation pursuant to Regulation (EC) No 726/2004 in a third country and provide reliable proof to that effect. Member States should also be able to issue vaccine certificates to Union citizens and their family members who have been vaccinated with a vaccine that has received a WHO Emergency Use Listing, and where they provide reliable proof to that effect.

(24) On 27 January 2021, the eHealth Network adopted guidelines on proof of vaccination for medical purposes, which it updated on 12 March 2021 (12). These guidelines, in particular the preferred code standards, should form the basis for the technical specifications adopted for the purpose of this Regulation.

(25) Already now, several Member States exempt vaccinated persons from certain restrictions to free movement within the Union. ▌Member States should accept proof of vaccination in order to waive restrictions to free movement put in place, in compliance with Union law, to limit the spread of COVID-19, such as requirements to undergo quarantine/self-isolation or be tested for SARS-CoV-2 infection, and they should be required to accept, under the same conditions, valid vaccination certificates issued by other Member States in compliance with this Regulation. This acceptance should take place under the same conditions, meaning that, for example, where a Member State considers sufficient a single dose of a vaccine administered, it should do so also for holders of a vaccination certificate indicating a single dose of the same vaccine. On grounds of public health, this obligation should be limited to persons having received COVID-19 vaccines having been granted marketing authorisation pursuant to Regulation (EC) No 726/2004 ▌or vaccines having received a WHO Emergency Use Listing.

(26) It is necessary to prevent any kind of discrimination (direct or indirect) against persons who are not vaccinated, for example because of medical reasons, because they are not part of the target group for which the vaccine is currently administered , or because they have not yet had the opportunity or chose not to be vaccinated , or where there is no vaccine available yet for certain age categories, like children . Therefore, possession of a vaccination certificate, or the possession of a vaccination certificate indicating a specific vaccine medicinal product, should not be a pre-condition to exercise free movement rights ▌ and cannot be a pre-condition to free movement within the Union and to use cross-border passenger transport services such as airlines, trains, coaches, ferries or any other means of transport.

(26a) COVID-19 vaccines need to be produced at scale, priced affordably, allocated globally so that they are available where needed, and widely deployed in local communities. [Am. 21/rev]

(26b) Tackling the COVID-19 pandemic is a prerequisite for social and economic recovery and for the effectiveness of the recovery efforts. The development of COVID-19 vaccines is essential. The problems with serious cases of non-compliance with production and delivery schedules are very concerning. [Am. 22/rev]

(27) Many Member States have been requiring persons travelling to their territory to undergo a test for SARS-CoV-2 infection before or after arrival. At the beginning of the COVID-19 pandemic, Member States typically relied on reverse transcription polymerase chain reaction (RT-PCR), which is a nucleic acid amplification test (NAAT) for COVID-19 diagnostics considered by the WHO and ECDC as the ‘gold standard’, that is, the most reliable methodology for testing of cases and contacts (13). As the pandemic has progressed, a new generation of faster and cheaper tests has become available on the European market, the so-called rapid antigen tests, which detect the presence of viral proteins (antigens) to detect an ongoing infection. On 18 November 2020, the Commission adopted Commission Recommendation (EU) 2020/1743 on the use of rapid antigen tests for the diagnosis of SARS-CoV-2 infection (14).

(28) On 22 January 2021, the Council adopted Council Recommendation 2021/C 24/01 on a common framework for the use and validation of rapid antigen tests and the mutual recognition of COVID-19 test results in the EU (15), which provides for the development of a common list of COVID-19 rapid antigen tests. On this basis, the Health Security Committee agreed, on 18 February 2021, on a common list of COVID-19 rapid antigen tests, a selection of rapid antigen tests for which Member States will mutually recognise their results, and a common standardised set of data to be included in COVID-19 test result certificates (16).

(29) Despite these common efforts, persons exercising their free movement right still face problems when trying to use a test result obtained in one Member State in another. These problems are often linked to the language in which the test result is issued, ▌to lack of trust in the authenticity of the document shown , and to the costs of tests .

(30) To improve the acceptance of test results carried out in another Member State when presenting such results for the purposes of exercising free movement, an interoperable test certificate should be established, containing the strictly necessary information to clearly identify the holder as well as the type, date and result of the test for SARS-CoV-2 infection. To ensure the reliability of the test result, only the results of NAAT tests and rapid antigen tests featured in the list established on the basis of Council Recommendation 2021/C 24/01 should be eligible for a test certificate issued on the basis of this Regulation. The common standardised set of data to be included in COVID-19 test result certificates agreed by the Health Security Committee on the basis of Council Recommendation 2021/C 24/01, in particular the preferred code standards, should form the basis for the technical specifications adopted for the purpose of this Regulation.

(31) Test certificates issued by Member States in compliance with this Regulation should be accepted by Member States requiring proof of a test for SARS-CoV-2 infection in order to waive restrictions to free movement put in place to limit the spread of COVID-19.

(31a) Antibodies to SARS-CoV-2 are produced either after a natural infection — either with or without a clinical disease — and after vaccination. While we do not have definitive data yet on the persistence of those antibodies after vaccination, there is abundant evidence that naturally induced antibodies are detectable for several months after the infection. Testing for antibodies therefore allows to identify persons who have been previously infected and who may have developed immune response and therefore have a very low likelihood to get infected again or infect others.

(32) According to existing evidence, persons who have recovered from COVID-19 can continue to test positive for SARS-CoV-2 for a certain period after symptom onset (17). Where such persons are required to undergo a test when seeking to exercise free movement, they may thus be effectively prevented from travelling despite no longer being infectious. For the purpose of facilitating free movement, and of ensuring that restrictions of free movement currently in place during the COVID-19 pandemic can be lifted in a coordinated manner based on the latest scientific evidence available, an interoperable certificate of recovery should be established, containing the necessary information to clearly identify the person concerned and the date of a previous positive test for SARS-CoV-2 infection. ▌According to ECDC, recent evidence shows that despite shedding of viable SARS-CoV-2 between ten and twenty days from the onset of symptoms, convincing epidemiological studies have failed to show onward transmission of disease after day ten. The precautionary principle should, however, still apply. The Commission should be empowered to change the validity period , both the starting and ending points, on the basis of guidance from the Health Security Committee or from ECDC, which is closely studying the evidence base for the duration of acquired immunity after recovery. In addition, individuals should have the option to undergo a highly specific test for the spike antigen in case they are asymptomatic.

(33) Already now, several Member States exempt recovered persons from certain restrictions to free movement within the Union. ▌Member States should accept proof of recovery in order to waive restrictions to free movement put in place, in compliance with Union law, to limit the spread of SARS-CoV-2, such as requirements to undergo quarantine/self-isolation or be tested for SARS-CoV-2 infection, and they should be required to accept, under the same conditions, valid certificates of recovery issued by other Member States in compliance with this Regulation. The eHealth Network, in collaboration with Health Security Committee, is also working on guidelines on recovery certificates and respective datasets.

(34) To be able to obtain a common position quickly, the Commission should be able to ask the Health Security Committee established by Article 17 of Decision No 1082/2013/EU of the European Parliament and of the Council (18) to issue guidance about the available scientific evidence concerning the effects of medical events documented in the certificates established in accordance with this Regulation, including the effectiveness and duration of the immunity conferred by COVID-19 vaccines, whether vaccines prevent asymptomatic infection and transmission of the virus, the situation of people having recovered from the virus, and the impacts of the new SARS-CoV-2 variants on people having been vaccinated or already infected . Such information could also form the basis for Council Recommendations to enable a coordinated approach for lifting restrictions on the free movement of holders of certificates.

(35) In order to ensure uniform conditions for the implementation of the trust framework certificates established by this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (19).

(36) The Commission should adopt immediately applicable implementing acts where, in duly justified cases relating to the technical specifications necessary to establish interoperable certificates, imperative grounds of urgency so require or when new scientific evidence becomes available.

(37) Regulation (EU) 2016/679 of the European Parliament and of the Council (20) applies to the processing of personal data carried out when implementing this Regulation. This Regulation establishes the legal ground for the processing of personal data, within the meaning of Articles 6(1)(c) and 9(2)(g) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It ▌does not regulate the processing of personal data related to the documentation of a vaccination, test or recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records. The legal basis for processing for other purposes is to be provided for in national law, which must comply with Union data protection legislation.

(38) In line with the principle of minimisation of personal data, the certificates should only contain the personal data strictly necessary for the purpose of facilitating the exercise of the right to free movement within the Union during the COVID-19 pandemic. The specific categories of personal data and data fields to be included in the certificates should be set out in this Regulation.

(39) For the purposes of this Regulation, personal data do not need to be transmitted/exchanged across borders ▌. In line with the public-key infrastructure approach, only the public keys of the issuers need to be transferred or accessed across borders, which will be ensured by an interoperability gateway set up and maintained by the Commission. In particular, the presence of the certificate combined with the public key of the issuer should allow for the verification of the authenticity and integrity of the certificate and for the detection of fraud. In line with the principle of data protection by default, verification techniques not requiring transmission of personal data should be employed.

(40) This Regulation prohibits retention of personal data obtained from the certificate by the Member State of destination or by ▌cross-border passenger transport services operators ▌. This Regulation does not create a legal basis for the establishment of any repository of database at Member State or Union level or through the trust framework digital infrastructure.

▌

(41a) Clear, comprehensive and timely communication to the public on the issuance, use and acceptance of each type of certificate making up the EU COVID-19 Certificate is crucial to ensure predictability for travel and legal certainty. The Commission should support the Member States’ efforts in this regard, for example by making available the information provided by Member States on the ‘Re-open EU’ web platform.

(42) In accordance with Recommendation (EU) 2020/1475, any restrictions to the free movement of persons within the Union put in place to limit the spread of SARS-CoV-2 should be lifted as soon as the epidemiological situation allows. This also applies to obligations to present documents other than those required by Union law, in particular Directive 2004/38/EC, such as the certificates covered by this Regulation. ▌

(43) This Regulation should apply for 12 months from the date of its entry into force. Four months after the date of entry into force of this Regulation and at the latest 3 months before the end of its application, the Commission should present a report to the European Parliament and the Council on the application of this Regulation, including on its impact on free movement, fundamental rights, the protection of personal data, as well as an assessment of the most up-to-date vaccine and testing technologies, and uses by the Member States of the EU COVID-19 Certificate for purposes, based on national law, not provided for in this Regulation .

(44) In order to take into account the epidemiological situation and the progress in containing the COVID-19 pandemic and to ensure interoperability with international standards, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of the application of certain Articles of this Regulation ▌. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016 (21). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(45) Since the objectives of this Regulation, namely to facilitate the free movement within the Union during the COVID-19 pandemic by establishing interoperable certificates on the holder’s vaccination, testing and recovery status, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

(46) This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights (‘Charter’), including the right to respect for private life and family life, the right to the protection of personal data, the right to equality before the law and non-discrimination, the right to free movement and the right to an effective remedy. Member States should comply with the Charter when implementing this Regulation.

(46a) As far as Member States decide to require national digital certificates for other purposes than free movement at a national level, those should be interoperable with the EU COVID-19 Certificate and respect its safeguards as defined in this Regulation, in particular to ensure non-discrimination between different nationalities, non-discrimination between different certificates, high standards of data protection and to avoid fragmentation.

(46b) Member States should not introduce restrictions to access to public services with respect to those who do not hold the certificates covered by this Regulation.

(46c) A list of all the entities foreseen to be acting as controllers, processors and recipients of the data in that Member State shall be made public within a period of one month after the date of entry into force of this Regulation in order to allow the Union citizens making use of the EU COVID-19 Certificate to know the identity of the entity to whom they may turn to for the exercise of their data protection rights under Regulation (EU) 2016/679, including in particular the right to receive transparent information on the ways in which data subject’s rights may be exercised with respect to the processing of personal data.

(47) The European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB) have been consulted pursuant to Article 42 (2) of Regulation (EU) 2018/1725 (22),

HAVE ADOPTED THIS REGULATION:

Article 1 Subject matter This Regulation lays down a framework for the issuance, verification and acceptance of interoperable certificates on COVID-19 vaccination, testing and recovery for the purpose of facilitating the holders’ exercise of their right to free movement during the COVID-19 pandemic (‘ EU COVID-19 Certificate ’). It provides for the legal ground to process personal data necessary to issue such certificates and to process the information necessary to confirm and verify the authenticity and validity of such certificates in full compliance with Regulation (EU) 2016/679 . It cannot be interpreted as establishing a direct or indirect right or obligation for persons to be vaccinated. [Am. 9] This Regulation does not introduce or establish any additional formality or requirement for the exercise of the right to free movement or the right of entry in the territory of the Member States pursuant to Directive 2004/38/EC and Regulation (EU) 2016/399 .

Article 2 Definitions For the purposes of this Regulation, the following definitions apply: (1) ‘holder’ means the person to whom an interoperable certificate containing information about his or her vaccination, testing and/or recovery status has been issued in accordance with this Regulation. (2) ‘ EU COVID-19 Certificate ’ means interoperable certificates containing information about the vaccination, testing and/or recovery status of the holder issued in the context of the COVID-19 pandemic; (3) ‘COVID-19 vaccine’ means an immunological medicinal product indicated for active immunisation against severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), the virus that causes COVID-19; (4) ‘NAAT test’ means a molecular nucleic acid amplification test (NAAT), such as reverse transcription polymerase chain reaction (RT-PCR), loop-mediated isothermal amplification (LAMP) and transcription-mediated amplification (TMA) techniques, used to detect the presence of the SARS-CoV-2 ribonucleic acid (RNA); (5) ‘rapid antigen test’ means a testing method that relies on detection of viral proteins (antigens) using a lateral flow immunoassay that gives results in less than 30 minutes conducted by a trained healthcare professional or other trained operator ; (5a) ‘serology or antibody test’ means a laboratory-based test performed on blood samples (serum, plasma, or whole blood) aiming to detect if a person has developed antibodies against SARS-CoV-2, thus indicating that the holder has been exposed to SARS-CoV-2 and has developed antibodies, regardless of whether he or she was symptomatic or not; (6) ‘interoperability’ means the capability of verifying systems in a Member State to use data encoded by another Member State; (7) ‘barcode’ means a method of storing and representing data in a visual, machine-readable format; (8) ‘electronic seal’ means ‘advanced electronic seal’ as defined in Regulation (EU) No 910/2014 of the European Parliament and of the Council (23), which is attached to and logically associated with other data in electronic form to ensure the latter’s origin and integrity; ▌ (10) ‘trust framework’ means the rules, policies, specifications, protocols, data formats and digital infrastructure regulating and allowing for the reliable and secure issuance and verification of certificates to guarantee the certificates’ trustworthiness by confirming their authenticity, validity and integrity, ▌by the ▌use of electronic seals ▌.

Article 3 EU COVID-19 Certificate 1. Without prejudice to Article 22 of Regulation (EU) 2016/399 the interoperable EU COVID-19 Certificate shall allow for the issuance and cross-border verification and acceptance of any of the following certificates: (a) a certificate confirming that the holder has received a COVID-19 vaccine in the Member State issuing the certificate (‘vaccination certificate’); (b) a certificate indicating the holder’s result , type and date of a NAAT test or a rapid antigen test listed in the common and updated list of COVID-19 rapid antigen tests established on the basis of Council Recommendation 2021/C 24/01 (24) (‘test certificate’); (c) a certificate confirming that the holder has recovered from a SARS-CoV-2 infection following a positive NAAT test or having confirmation of an immune response against SARS-CoV-2 by means of a serology or antibody test, including the date of the first positive NAAT test or the date of serological testing for antibodies against SARS-CoV-2 (‘certificate of recovery’). The Commission shall publish the list of COVID-19 rapid antigen tests established on the basis of Council Recommendation 2021/C 24/01, including any updates. 2. Member States shall issue the certificates referred to in paragraph 1 in a digital and a paper-based format ▌. The prospective holders shall be entitled to receive the certificates in the format of their choice The certificates issued by Member States shall be user-friendly and contain an interoperable barcode allowing for the verification of the authenticity, validity and integrity of the certificate. The barcode shall comply with the technical specifications established in accordance with Article 8. The information contained in the certificates shall also be shown in human-readable form , shall be accessible to persons with disabilities, and shall be, at least, in the official language or languages of the issuing Member State and English. [Am. 15] 3. The certificates referred to in paragraph 1 shall be issued free of charge. The holder shall be entitled to request the issuance of a new certificate if the personal data contained in the certificate is not or no longer accurate or up to date, including with regard to the vaccination, test or recovery status of the holder, or if the certificate is no longer available to the holder. 3a. The certificate shall include the following text: ‘This certificate is not a travel document. The scientific evidence on COVID-19 vaccination, testing and recovery continues to evolve, also in view of new variants of concern of the virus. Before travelling, please check the applicable public health measures and related restrictions applied at the point of destination.’ The Member State shall provide the holder with clear, comprehensive and timely information on the use of the vaccination certificate, test certificate, and/or recovery certificate for the purposes of this Regulation. 3b. Possession of a EU COVID-19 Certificate shall not be a precondition to exercise free movement rights. 3c. Issuance of certificates pursuant to paragraph 1 shall not lead to differential treatment and discrimination based on vaccination status or the possession of a specific certificate referred to in Articles 5, 6 and 7. Member States shall ensure universal, accessible, timely and free of charge testing possibilities in order to guarantee the right to free movement inside the Union without discrimination on grounds of economic or financial possibilities. 4. Issuance of the certificates referred to in paragraph 1 shall not affect the validity of other proofs of vaccination, test or recovery issued before the entry into application of this Regulation or for other purposes, in particular for medical purposes. 4a. Union transport hubs, such as airports, ports, and railway and bus stations, where the certificates referred to in paragraph 1 are verified shall apply standardised and common criteria and procedures for their verification, on the basis of guidance developed by the Commission. 5. Where the Commission has adopted an implementing act pursuant to the second sub-paragraph, certificates issued in accordance with this Regulation by a third country with which the European Union and its Member States have concluded an agreement on free movement of persons allowing the contracting parties to restrict such free movement on grounds of public health in a non-discriminatory manner and which does not contain a mechanism of incorporation of European Union acts shall be accepted under the conditions referred to in Article 5(5). The Commission shall assess whether such a third country issues certificates in accordance with this Regulation and has provided formal assurances that it will accept certificates issued by the Member States. In that case, it shall adopt an implementing act in accordance with the examination procedure referred to in Article 13(2). 6. The Commission shall ask the Health Security Committee established by Article 17 of Decision No 1082/2013/EU, the ECDC and the EMA to issue guidance on the available scientific evidence on the effects of medical events documented in the certificates referred to in paragraph 1. 6a. Member States shall make available sufficient resources to implement this Regulation, including to prevent, detect, investigate and prosecute fraud and illicit practices regarding the issuance and use of the EU COVID-19 Certificate.

Article 4 EU COVID-19 Certificate trust framework 1. The Commission and the Member States shall set up and maintain a trust framework digital infrastructure allowing for the secure issuance and verification of the certificates referred to in Article 3. 2. The trust framework shall ensure, where possible, interoperability with technological systems established at international level. 3. Where the Commission has adopted an implementing act pursuant to the second sub-paragraph, certificates issued by third countries to Union citizens and their family members, as well as to nationals or residents of Andorra, Monaco, San Marino and the Vatican/Holy See, according to an international standard and technological system that are interoperable with the trust framework established on the basis of this Regulation and that allows for the verification of the authenticity, validity and integrity of the certificate, and which contain the data set out in the Annex shall be treated like certificates issued by Member States in accordance with this Regulation, for the purpose of facilitating the holders’ exercise of their right to free movement within the European Union. For the purposes of this sub-paragraph, the acceptance, by the Member States, of vaccination certificates issued by third countries shall take place under the conditions referred to in Article 5(5). The Commission shall assess whether certificates issued by a third country fulfil the conditions set out in this paragraph. In that case, it shall adopt an implementing act in accordance with the examination procedure referred to in Article 13(2). The Commission shall also keep a publicly accessible register of those third countries that fulfil the conditions of issuing certificates within the meaning of this Regulation.

Article 5 Vaccination certificate 1. Each Member State shall automatically issue vaccination certificates as referred to in Article 3(1)(a) to a person to whom a COVID-19 vaccine has been administered ▌. 2. The vaccination certificate shall contain the following categories of personal data: (a) identification of the holder; (b) information about the vaccine medicinal product administered and information about the number of doses and dates ; (c) certificate metadata, such as the certificate issuer ▌. The personal data shall be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the Annex. The Commission is empowered to adopt delegated acts in accordance with Article 11 to amend point 1 of the Annex by modifying or removing data fields, or by adding data fields falling under the categories of personal data mentioned in points (b) and (c) of this paragraph. 3. The vaccination certificate shall be issued in a secure and interoperable format as provided for in Article 3(2) and shall clearly indicate whether or not the vaccination course for that specific vaccine has been completed. 4. Where, in the case of newly emerging scientific evidence or to ensure interoperability with international standards and technological systems, imperative grounds of urgency so require, the procedure provided for in Article 12 shall apply to delegated acts adopted pursuant to this Article. 5. ▌Member States shall accept proof of vaccination in order to waive restrictions to free movement put in place, in compliance with Union law, to limit the spread of COVID-19, and they shall also accept, under the same conditions, valid vaccination certificates issued by other Member States in compliance with this Regulation for a COVID-19 vaccine having been granted marketing authorisation pursuant to Regulation (EC) No 726/2004. Member States may also accept, for the same purpose, valid vaccination certificates issued by other Member States in compliance with this Regulation for ▌a COVID-19 vaccine having received a WHO Emergency Use Listing. 6. Where a Union citizen or a family member of a Union citizen or a national or resident of Andorra, Monaco, San Marino and the Vatican/Holy See, has been vaccinated in a third country with one of the types of COVID-19 vaccines referred to in paragraph 5 of this Article, and where the authorities of a Member State have been provided with all necessary information, including reliable proof of vaccination, they shall issue a vaccination certificate as referred to in Article 3(1)(a) to the person concerned.

Article 6 Test certificate 1. Each Member State shall automatically issue test certificates as referred to in Article 3(1)(b) to persons tested for COVID-19 ▌. 2. The test certificate shall contain the following categories of personal data: (a) identification of the holder; (b) information about the test carried out; (c) certificate metadata, such as the certificate issuer ▌. The personal data shall be included in the test certificate in accordance with the specific data fields set out in point 2 of the Annex. The Commission is empowered to adopt delegated acts in accordance with Article 11 to amend point 2 of the Annex by modifying or removing data fields, or by adding data fields falling under the categories of personal data mentioned in points (b) and (c) of this paragraph . 3. The test certificate shall be issued in a secure and interoperable format as provided for in Article 3(2). 4. Where, in the case of newly emerging scientific evidence or to ensure interoperability with international standards and technological systems, imperative grounds of urgency so require, the procedure provided for in Article 12 shall apply to delegated acts adopted pursuant to this Article. 5. ▌Member States shall accept proof of a negative test for SARS-CoV-2 infection i n order to waive restrictions to free movement put in place, in compliance with Union law, to limit the spread of COVID-19, and they shall also accept valid test certificates issued by other Member States in compliance with this Regulation.

Article 7 Certificate of recovery 1. Each Member State shall issue, upon request, certificates of recovery as referred to in Article 3(1)(c) at the earliest from the eleventh day after a person has received his or her first positive test for SARS-CoV-2 infection , or after submission of a subsequent negative NAAT test. It shall also be possible to issue a certificate of recovery through the detection of antibodies by a serological test. The Commission is empowered to adopt delegated acts in accordance with Article 11 to amend the number of days as of which a certificate of recovery may be issued based on guidance received from the Health Security Committee in accordance with Article 3(6) or on scientific evidence reviewed by ECDC. The Commission is empowered to adopt delegated acts in accordance with Article 11 to establish and amend the types of serological tests for antibodies against SARS-CoV-2 in respect of which a certificate of recovery may be issued, based on scientific evidence reviewed by ECDC. 2. The certificate of recovery shall contain the following categories of personal data: (a) identification of the holder; (b) information about past SARS-CoV-2 infection documented by a positive NAAT test, or outcome of serology test; (c) certificate metadata, such as the certificate issuer ▌. The personal data shall be included in the certificate of recovery in accordance with the specific data fields set out in point 3 of the Annex. The Commission is empowered to adopt delegated acts in accordance with Article 11 to amend point 3 of the Annex by modifying or removing data fields, including until when a certificate of recovery shall be valid , or by adding data fields falling under the categories of personal data mentioned in points (b) and (c) of this paragraph . 3. The certificate of recovery shall be issued in a secure and interoperable format as provided for in Article 3(2). 4. Where, in the case of newly emerging scientific evidence or to ensure interoperability with international standards and technological systems, imperative grounds of urgency so require, the procedure provided for in Article 12 shall apply to delegated acts adopted pursuant to this Article. 5. ▌Member States shall accept proof of recovery from SARS-CoV-2 infection as a basis for waiving restrictions to free movement put in place, in compliance with Union law, to limit the spread of COVID-19, and they shall accept, under the same conditions, valid certificates of recovery issued by other Member States in compliance with this Regulation.

Article 8 Technical specifications To ensure uniform conditions for implementation of the trust framework established by this Regulation, the Commission shall adopt implementing acts containing the technical specifications and rules to: (a) securely issue and verify the certificates referred to Article 3; (b) ensure the security of the personal data, taking into account the nature of the data; (c) populate the certificates referred to Article 3, including the coding system and any other relevant elements; ▌ (e) issue a valid, secure and interoperable barcode; (f) ensure interoperability with international standards and/or technological systems; (g) allocate responsibilities amongst controllers and as regards processors in accordance with Chapter IV of Regulation (EU) 2016/679; (ga) establish processes for a regular testing, assessment and evaluation of the effectiveness of the data protection and security measures adopted; (gb) ensure accessibility for persons with disabilities to the human-readable information contained in the digital certificate and in the paper-based certificate, in line with Union harmonised accessibility requirements. [Am. 16] Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 13(2). When the envisaged implementing act concerns the processing of personal data, the Commission shall consult the EDPS, and, where applicable, may consult the EDPB. On duly justified imperative grounds of urgency, in particular to ensure a timely implementation of the trust framework, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 13(3). The trust framework shall be based on a public key infrastructure to verify the integrity of the EU COVID-19 Certificates and the authenticity of the electronic seals. The trust framework shall allow for detection against fraud, in particular forgery, and shall ensure that the verification of EU COVID-19 Certificates and electronic seals does not inform the issuer about the verification.

Article 8a National digital certificates and interoperability with the EU COVID-19 Certificate trust framework Where a Member State has adopted or adopts a national digital certificate for purely domestic purposes, it shall ensure that it is fully interoperable with the EU COVID-19 Certificate trust framework. The same safeguards as in this Regulation shall apply.

Article 8b Further use of the EU COVID-19 Certificate framework Where a Member State seeks to implement the EU COVID-19 Certificate for any possible use other than the intended purpose of facilitating free movement between Member States, that Member State shall create a legal basis under national law, complying with the principles of effectiveness, necessity, and proportionality, including specific provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entities that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects. No data shall be retained in the context of the verification process. [Am. 12]

Article 9 Protection of personal data 1. Regulation (EU) 2016/679 shall apply to the processing of personal data carried out when implementing this Regulation. The personal data contained in the certificates issued in accordance with this Regulation shall be processed only for the purpose of ▌verifying the information included in the certificate in order to facilitate the exercise of the right of free movement within the Union as provided for in this Regulation and until it ceases to apply . 2. The personal data included in the certificates referred to in Article 3 shall be processed by the competent authorities of the Member State of destination, or by the cross-border passenger transport services operators required by national law to implement certain public health measures during the COVID-19 pandemic, only to confirm and verify the holder’s vaccination, testing or recovery status. For this purpose, the personal data shall be limited to what is strictly necessary. The personal data accessed pursuant to this paragraph shall not be retained or processed by the verifier for other purposes. A separate independent certificate shall be issued for each vaccination, test or recovery, and no history of the previous certificates of the holder shall be stored on the certificate. 3. The personal data processed for the purpose of issuing the certificates referred to in Article 3, including the issuance of a new certificate, shall not be retained by the issuer longer than is strictly necessary for its purpose and in no case longer than the period for which the certificates may be used to exercise the right to free movement, after which the personal data shall be erased immediately and irrevocably. There shall be no centralised processing or retention of the personal data included in the certificate at Member State or Union level. 4. The authorities or other designated bodies responsible for issuing the certificates referred to in Article 3 shall be considered as controllers referred to in Article 4(7) of Regulation (EU) 2016/679. By … [one month after the date of entry into force of this Regulation], the Member States shall make public the entities foreseen to be acting as controllers, processors and recipients of the data and communicate this information to the Commission and any modifications thereto regularly after that date. By … [two months after the date of entry into force of this Regulation], the Commission shall publish the collected information in a publicly accessible list and keep that public list up to date. 5. The data controllers and processors shall take adequate technical and organisational measures to ensure a level of security appropriate to the risk of the processing. 6. Where a controller referred to in paragraph 4 enlists a processor, in application of Article 28(3) of Regulation (EU) 2016/679, no transfer of personal data by the processor to a third country may take place.

Article 10 EU COVID-19 Certificate and travel restrictions Member States shall not introduce and implement additional travel restrictions such as quarantine, self-isolation or a test for SARS-CoV-2 infection, or any discriminatory measures for holders of certificates referred to in Article 3, upon the introduction of the EU COVID-19 Certificate .

Article 11 Exercise of the delegation 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Articles 5(2), 6(2), 7(1) and 7(2) ▌ shall be conferred on the Commission for a period of 12 months from [date of entry into force]. 3. The delegation of power referred to in Articles 5(2), 6(2), 7(1) and 7(2) ▌ may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016. When such a delegated act concerns the processing of personal data, the Commission shall consult the EDPS and, where applicable, may consult the EDPB. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Articles 5(2), 6(2), 7(1) and 7(2) ▌shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 12 Urgency procedure 1. Delegated acts adopted under this Article shall enter into force without delay and shall apply as long as no objection is expressed in accordance with paragraph 2. The notification of a delegated act to the European Parliament and to the Council shall state the reasons for the use of the urgency procedure. 2. Either the European Parliament or the Council may object to a delegated act in accordance with the procedure referred to in Article 11(6). In such a case, the Commission shall repeal the act immediately following the notification of the decision to object by the European Parliament or by the Council.

Article 13 Committee procedure 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. 3. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.

Article 14 Reporting 1. By … [4 months after the date of entry into force of this Regulation] , the Commission shall present a report to the European Parliament and the Council on the application of this Regulation. ▌ 2. The report shall include an assessment of the impact of this Regulation on free movement, including on travel and tourism, on fundamental rights and in particular non-discrimination, on the protection of personal data, as well as information on the most up to date vaccine and testing technologies, based, inter alia, on information provided by the ECDC. The report shall also include an assessment of uses by the Member States of the EU COVID-19 Certificate for purposes, based on national law, not provided for in this Regulation. 3. At the latest three months before the end of the application of this Regulation, the Commission shall present a report to the European Parliament and the Council on the application of this Regulation. This report shall carry out an assessment in accordance with paragraph 2. It may be accompanied by legislative proposals, in particular to extend the date of application of this Regulation, taking into account the evolution of the epidemiological situation and based on the principles of necessity, proportionality and effectiveness.

Article 15 Entry into force and applicability 1. This Regulation shall enter into force on and apply from the ▌day following that of its publication in the Official Journal of the European Union. 2. The Regulation shall cease to apply 12 months from … [date of entry into force of this Regulation]. ▌