# Towards a GDPR-Compliant Blockchain-Based COVID Vaccination Passport
## 3 Methodology  
### Identification of Design Requirements  
To formulate the architectural framework for the COVID vaccination passport, the first step was to identify the aspects that could have an impact on the design of COVID vaccination passports. To identify the design requirements, we collected the requirements from different sources and activities. (1) We analyzed the two existing blockchain solutions deployed for verification and integrity checks using the case study research method [40]. We collected technical and marketing documentation of these blockchain solutions. One of the solutions is based on multi-tenant blockchain-based proof of content integrity by X Group. The salient feature of the proposed solution is trust, and it focuses on how to prove the stored information, or its metadata has not been modified. The solution is based on storing proof of integrity onto the blockchain. The solution is very much relevant to the context considered in this paper. However, the other solution which was analyzed is a blockchain-based platform for exchanging business documents in a machine-readable format. All transactions are validated to ensure high quality of data. In a broader perspective, the solution assists in managing the supply chain while maintaining interoperability between different parties. The aspect of GDPR compliance was very important and how these issues have been tackled in the solution was of prime significance. (2) We collected and analyzed data from expert interviews working in six leading blockchain companies operating in Finland. The data were collected using semi-structured interviews. The average length of the interviews was approximately 1 h. To identify how practitioners tackle the GDPR challenges in their use cases, the data from interviews was content analyzed utilizing qualitative coding [41]. Coding is a technique employed in qualitative research for analyzing data items to identify concepts and find a relation between the data items. There are different approaches to qualitative coding, however, the one used in this case is data-driven coding or open coding. (3) We have analyzed the data collected from 5 incoming travelers in Finland during this pandemic time. The travelers are from outside the European Union. They explained their experiences at the Helsinki Vantaa Airport and immigration. One of the travelers mentioned:  
\"When I arrived at Helsinki Airport, I had to show my COVID negative certificate to the health authority at the airport in the arrival section. They were stationed with desks and chairs and tables. The health checking and verification is maintained by Finnish Institute for Health and Welfare. The booth was located was before the immigration departure. I had to show my identity documents as well as my COVID test report. After verifying my report with the QR code attached in my COVID report, I was instructed to do another COVID test after 72 h. If the result came negative, I could end my quarantine. After this station, there was no other verification at the immigration departure\". Another traveler who arrived a week later also experienced a similar situation. In addition, there is also COVID test-taking facilities at the airport, where one can get tested for COVID before entering Finland. One of the interviewed travelers did the COVID test at the airport since her COVID report was a little over 72 h. The Finnish health services inform each traveler that if anyone does not want to get tested for COVID (second time) after entering Finland, a 14-day quarantine is mandatory. If there is no sign of COVID infection, the quarantine can end. Interview data analysis (using open/inducting coding) epitomizes a few common requirements, for example, having a COVID certificate or previous COVID history, timestamp needed for the time of test along with a verification mechanism such as QR code embedded in the report. (4) We studied and identified the relevant GDPR articles that have an impact on blockchain-based digital services.