REGULATION (EU) 2021/953 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

15.6.2021 | EN | Official Journal of the European Union | L 211/1 ---|---|---|--- * * * REGULATION (EU) 2021/953 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 21(2) thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee (1), Acting in accordance with the ordinary legislative procedure (2), Whereas: (1) | Every citizen of the Union has the fundamental right to move and reside freely within the territory of the Member States, subject to the limitations and conditions laid down in the Treaties and by the measures adopted to give effect to them. Directive 2004/38/EC of the European Parliament and of the Council (3) lays down detailed rules as regards the exercise of that right. ---|--- (2) | On 30 January 2020, the Director-General of the World Health Organization (WHO) declared a public health emergency of international concern over the global outbreak of severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), which causes coronavirus disease 2019 (COVID-19). On 11 March 2020, the WHO made an assessment characterising COVID-19 as a pandemic. ---|--- (3) | To limit the spread of SARS-CoV-2, the Member States have adopted some measures which have had an impact on the exercise by Union citizens of their right to move and reside freely within the territory of the Member States, such as entry restrictions or requirements for cross-border travellers to undergo quarantine or self-isolation or to be tested for SARS-CoV-2 infection. ---|--- (4) | On 13 October 2020, the Council adopted Recommendation (EU) 2020/1475 (4), which introduced a coordinated approach to the restriction of free movement in response to the COVID-19 pandemic in the following key areas: the application of common criteria and thresholds when deciding whether to introduce restrictions to free movement, a mapping of risk areas of SARS-CoV-2 transmission based on an agreed colour code and a coordinated approach to any appropriate measures which could be applied to persons travelling to or from risk areas, depending on the level of risk of SARS-CoV-2 transmission in those areas. In view of their specific situation, the Recommendation emphasises that travellers with an essential function or need, as listed in point 19 of the Recommendation, and persons living in border regions and travelling across the border on a daily or frequent basis for the purposes of work, business, education, family, medical care or caregiving, whose lives are particularly affected by such restrictions, in particular those who exercise critical functions or who are essential for critical infrastructure, should in general be exempted from travel restrictions linked to the COVID-19 pandemic. ---|--- (5) | Using the criteria and thresholds established in Recommendation (EU) 2020/1475, the European Centre for Disease Prevention and Control (ECDC) has been publishing, on a weekly basis, a map of Member States, with data on the notification, testing and test positivity rates of COVID-19, broken down by region, in order to support Member States’ decision-making. ---|--- (6) | Member States may, in accordance with Union law, limit the fundamental right of free movement on grounds of public health. Any restrictions to the free movement of persons within the Union that are put in place to limit the spread of SARS-CoV-2 should be based on specific and limited public interest grounds, namely the safeguarding of public health as emphasised by Recommendation (EU) 2020/1475. It is necessary for such limitations to be applied in accordance with the general principles of Union law, in particular proportionality and non-discrimination. Any measures taken should therefore be strictly limited in scope and time, in line with the efforts to restore free movement within the Union, and should not extend beyond what is strictly necessary to safeguard public health. Furthermore, such measures should be consistent with measures taken by the Union to ensure the seamless free movement of goods and essential services across the internal market, including the free movement of medical supplies and medical and healthcare personnel through the ‘green lane’ border crossings referred to in the Commission communication of 23 March 2020 on the implementation of the Green Lanes under the Guidelines for border management measures to protect health and ensure the availability of goods and essential services. ---|--- (7) | Persons who are vaccinated or who have had a recent negative COVID-19 test result and persons who have recovered from COVID-19 in the previous six months seem to have a reduced risk of infecting people with SARS-CoV-2, according to current and still evolving scientific evidence. The free movement of persons who, according to sound scientific evidence, do not pose a significant risk to public health, for example because they are immune to and cannot transmit SARS-CoV-2, should not be restricted, as such restrictions would not be necessary to achieve the objective of safeguarding public health. Where the epidemiological situation allows, such persons should not be subject to additional restrictions to free movement linked to the COVID-19 pandemic, such as travel-related testing for SARS-CoV-2 infection or travel-related quarantine or self-isolation, unless such additional restrictions are, based on the latest available scientific evidence and in line with the precautionary principle, necessary and proportionate for the purpose of safeguarding public health, and non-discriminatory. ---|--- (8) | Many Member States have launched or plan to launch initiatives to issue COVID-19 vaccination certificates. However, for such vaccination certificates to be used effectively in a cross-border context when Union citizens exercise their right to free movement, they need to be fully interoperable, compatible, secure and verifiable. A common approach is required among Member States on the content, format, principles, technical standards and the level of security of such vaccination certificates. ---|--- (9) | Unilateral measures to limit the spread of SARS-CoV-2 have the potential to cause significant disruption to the exercise of the right to free movement and to hinder the proper functioning of the internal market, including the tourism sector, as national authorities and passenger transport services, such as airlines, trains, coaches and ferries, could be confronted with a wide array of diverging document formats, not only regarding certificate holders’ COVID-19 vaccination, but also their test results and recovery. ---|--- (10) | In its resolution of 25 March 2021 on establishing an EU strategy for sustainable tourism, the European Parliament called for a harmonised approach to tourism across the Union by means of implementing common criteria for safe travel, with a Union Health Safety protocol for testing and quarantine requirements, a common vaccination certificate, once there is sufficient scientific evidence that vaccinated persons do not transmit SARS-CoV-2, and the mutual recognition of vaccination procedures. ---|--- (11) | In their statement of 25 March 2021, the Members of the European Council called for preparations to start on a common approach to the gradual lifting of restrictions to free movement in order to ensure that efforts are coordinated when the epidemiological situation allows for an easing of existing measures and for the work on COVID-19 interoperable and non-discriminatory digital certificates to be taken forward as a matter of urgency. ---|--- (12) | To facilitate the exercise of the right to move and reside freely within the territory of the Member States, a common framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) should be established. That common framework should be binding and directly applicable in all Member States. It should facilitate, whenever possible on the basis of scientific evidence, the gradual lifting of restrictions in a coordinated manner by Member States, taking into account the lifting of restrictions within their own territory. Regulation (EU) 2021/954 of the European Parliament and of the Council (5) extends that common framework to third-country nationals who are legally staying or residing in the Schengen area without controls at internal borders and applies as a matter of Schengen acquis, without prejudice to the specific rules on the crossing of internal borders set out in Regulation (EU) 2016/399 of the European Parliament and of the Council (6). Facilitating freedom of movement is one of the key preconditions for starting an economic recovery. ---|--- (13) | Although this Regulation is without prejudice to Member States’ competence to impose restrictions to free movement, in accordance with Union law, to limit the spread of SARS-CoV-2, it should contribute to facilitating the gradual lifting of such restrictions in a coordinated manner whenever possible, in accordance with Recommendation (EU) 2020/1475. Such restrictions could be waived in particular for vaccinated persons, in line with the precautionary principle, to the extent that scientific evidence on the effects of COVID-19 vaccination becomes increasingly available and more consistently conclusive with regard to the breaking of the transmission chain. ---|--- (14) | This Regulation is intended to facilitate the application of the principles of proportionality and non-discrimination with regard to restrictions to free movement during the COVID-19 pandemic, while pursuing a high level of public health protection. It should not be understood as facilitating or encouraging the adoption of restrictions to free movement, or restrictions to other fundamental rights, in response to the COVID-19 pandemic, given their detrimental effects on Union citizens and businesses. Any verification of the certificates making up the EU Digital COVID Certificate should not lead to further restrictions to the freedom of movement within the Union or to restrictions on travel within the Schengen area. The exemptions to the restrictions of free movement in response to the COVID-19 pandemic referred to in Recommendation (EU) 2020/1475 should continue to apply and the specific situation of cross-border communities, which have been particularly affected by such restrictions, should be taken into account. At the same time, the EU Digital COVID Certificate framework is intended to ensure that interoperable certificates are also available to travellers with an essential function or need. ---|--- (15) | The introduction of a common approach for the issuance, verification and acceptance of interoperable COVID-19 certificates relies upon mutual trust. The use of counterfeit COVID-19 certificates poses a significant risk to public health. Authorities in one Member State need assurance that the information included in a certificate issued in another Member State is trustworthy, that the certificate has not been forged, that the certificate belongs to the person presenting it, and that anyone verifying the certificate has access only to the minimum amount of information necessary. ---|--- (16) | On 1 February 2021, Europol issued an Early Warning Notification on the illicit sales of counterfeit COVID-19 test certificates indicating a negative result. Given the availability and ease of access to technological means, such as high-resolution printers and graphics editor software, fraudsters are able to produce high-quality counterfeit COVID-19 certificates. Cases of illicit sales of counterfeit COVID-19 test certificates have been reported, which involve organised forgery rings and opportunistic individuals selling counterfeit COVID-19 certificates on and offline. ---|--- (17) | It is important to make available sufficient resources to implement this Regulation and to prevent, detect, investigate and prosecute fraud and illicit practices regarding the issuance and use of the certificates making up the EU Digital COVID Certificate. ---|--- (18) | To ensure the interoperability of and equal access to the certificates making up the EU Digital COVID Certificate for all Union citizens, including for vulnerable persons, such as persons with disabilities, and for persons with limited access to digital technologies, Member States should issue such certificates in a digital or paper-based format, or both. The prospective holders should be entitled to receive the certificates in the format of their choice. This would allow them to request to receive a paper copy of the certificate, or to receive it in a digital format to be stored and displayed on a mobile device, or both. The certificates should contain an interoperable, digitally readable barcode giving access only to the data relevant to the certificates. Member States should ensure the authenticity, validity and integrity of the certificates through the use of electronic seals. To ensure a high level of trust in the authenticity, validity and integrity of certificates, Member States should, where possible, prioritise the use of advanced electronic seals as defined in point (26) of Article 3 of Regulation (EU) No 910/2014 of the European Parliament and of the Council (7). The information on the certificate should be shown in human-readable format, printed or displayed as plain text. The layout of the certificates should be easy to understand and ensure simplicity and user-friendliness. To avoid obstacles to free movement, the certificates should be issued free of charge, and Union citizens and their family members should have a right to have certificates issued to them. To prevent abuse or fraud, it should be possible to charge appropriate fees for the issuance of a new certificate in cases of repeated loss. Member States should issue the certificates making up the EU Digital COVID Certificate automatically or upon request, ensuring that they can be obtained easily and swiftly. Member States should also provide, where needed, the necessary support to allow for equal access by all Union citizens. A separate certificate should be issued for each vaccination, test result or recovery and should not contain data from previous certificates except where otherwise provided for in this Regulation. ---|--- (19) | Authentic certificates making up the EU Digital COVID Certificate should be individually identifiable by means of a unique certificate identifier, taking into account that holders might be issued more than one certificate during the COVID-19 pandemic. The unique certificate identifier is composed of an alphanumeric string and Member States should ensure that it does not contain any data linking it to other documents or identifiers, such as to passport or identity card numbers, in order to prevent directly identifying the holder. The unique certificate identifier should be used only for its intended purposes, which include requests for the issuance of a new certificate if a certificate is no longer available to the holder and the revocation of certificates. In addition, the use of a unique certificate identifier avoids the need to process other personal data that would otherwise be necessary to identify individual certificates. For medical and public health reasons and in the event of fraudulently issued or obtained certificates, Member States should be able to establish and exchange with other Member States for the purpose of this Regulation certificate revocation lists in limited cases, in particular in order to revoke certificates that have been issued erroneously, as a result of fraud or following the suspension of a COVID-19 vaccine batch found to be defective. Certificate revocation lists should not contain any personal data other than unique certificate identifiers. Holders of revoked certificates should be promptly informed about the revocation of their certificates and the reasons for the revocation. ---|--- (20) | The issuance of certificates pursuant to this Regulation should not lead to discrimination on the basis of the possession of a specific category of certificate. ---|--- (21) | Universal, timely and affordable access to COVID-19 vaccines and tests for SARS-CoV-2 infection, which form the basis for the issuance of the certificates making up the EU Digital COVID Certificate, is crucial in the fight against the COVID-19 pandemic and essential to restore freedom of movement within the Union. To facilitate the exercise of the right to free movement, Member States are encouraged to ensure affordable and widely available testing possibilities, taking into account that not the entire population would have had the opportunity to be vaccinated before the date of application of this Regulation. ---|--- (22) | The security, authenticity, validity and integrity of the certificates making up the EU Digital COVID Certificate and their compliance with Union data protection law are key to their acceptance in all Member States. It is therefore necessary to establish a trust framework laying out the rules on and infrastructure for the reliable and secure issuance and verification of COVID-19 certificates. The infrastructure should be developed, with a strong preference for the use of open-source technology, to function on different major operating systems, while ensuring that it is protected from cybersecurity threats. The trust framework should ensure that the verification of COVID-19 certificates can be carried out offline and without the issuer or any other third party being informed about the verification. The trust framework should be based on a public-key infrastructure with a trust chain from Member States’ health authorities or other trusted authorities to the individual entities issuing the COVID-19 certificates. The trust framework should allow for the detection of fraud, in particular forgery. The eHealth Network’s Outline Interoperability of Health Certificates Trust Framework of 12 March 2021 adopted pursuant to Article 14 of Directive 2011/24/EU of the European Parliament and of the Council (8) should form the basis for the trust framework for the EU Digital COVID Certificate. ---|--- (23) | Pursuant to this Regulation, the certificates making up the EU Digital COVID Certificate should be issued to the persons referred to in Article 3 of Directive 2004/38/EC, namely Union citizens and their family members, irrespective of their nationality, by the Member State where the vaccination was administered or the test carried out, or where the recovered person is located. Where reference is made to issuance by Member States, this should be understood as also covering issuance by designated bodies on behalf of Member States, including when COVID-19 certificates are issued in overseas countries and territories or the Faroe Islands on behalf of a Member State. Where relevant or appropriate, the certificates should be issued to another person on behalf of the vaccinated, tested or recovered person, for example to the legal guardian on behalf of legally incapacitated persons or to parents on behalf of their children. The certificates should not be subject to legalisation or any other similar formalities. ---|--- (24) | In accordance with Recommendation (EU) 2020/1475, Member States should pay particular attention to persons living in border regions and travelling across the border on a daily or frequent basis for the purposes of work, business, education, family, medical care or caregiving. ---|--- (25) | It should be possible for the certificates making up the EU Digital COVID Certificate to be issued to nationals or residents of Andorra, Monaco, San Marino and the Vatican or Holy See. ---|--- (26) | Agreements on free movement of persons concluded by the Union and the Member States, of the one part, and certain third countries, of the other part, provide for the possibility to restrict free movement on grounds of public health in a non-discriminatory manner. Where such an agreement does not contain a mechanism of incorporation of Union legal acts, COVID-19 certificates issued to beneficiaries of such agreements should be accepted under the conditions laid down in this Regulation. Such acceptance should be conditional on an implementing act to be adopted by the Commission establishing that such a third country issues COVID-19 certificates in accordance with this Regulation and has provided formal assurances that it will accept COVID-19 certificates issued by the Member States. ---|--- (27) | Regulation (EU) 2021/954 applies to third-country nationals who do not fall within the scope of this Regulation and who stay or reside legally in the territory of a Member State to which that Regulation applies and who are entitled to travel to other Member States in accordance with Union law. ---|--- (28) | The trust framework to be established for the purpose of this Regulation should seek to ensure consistency with global initiatives, in particular involving the WHO and the International Civil Aviation Organisation. Such consistency should include, where possible, interoperability between technological systems established at global level or by third countries with which the Union has close links and the systems established for the purpose of this Regulation to facilitate the exercise of the right to free movement within the Union, including through the participation in a public key infrastructure or the bilateral exchange of public keys. To facilitate the exercise of the right to free movement by Union citizens and their family members vaccinated or tested in third countries or in the overseas countries or territories referred to in Article 355(2) of the Treaty on the Functioning of the European Union (TFEU) and listed in Annex II thereto or the Faroe Islands, this Regulation should provide for the acceptance of COVID-19 certificates issued by third countries or by overseas countries or territories or the Faroe Islands to Union citizens and their family members where the Commission finds that those COVID-19 certificates are issued in accordance with standards that are to be considered as equivalent to those established pursuant to this Regulation. ---|--- (29) | For the purpose of facilitating free movement, and to ensure that restrictions to free movement currently in place during the COVID-19 pandemic can be lifted in a coordinated manner based on the latest scientific evidence and guidance made available by the Health Security Committee established by Article 17 of Decision No 1082/2013/EU of the European Parliament and of the Council (9), ECDC and the European Medicines Agency (EMA), an interoperable vaccination certificate should be established. Such a vaccination certificate should serve to confirm that the holder has received a COVID-19 vaccine in a Member State and should contribute to the gradual lifting of restrictions to free movement. The vaccination certificate should contain only the information necessary to clearly identify the holder as well as the COVID-19 vaccine administered, the number of doses, and the date and place of vaccination. Member States should issue vaccination certificates to persons who have received COVID-19 vaccines that have been granted a marketing authorisation pursuant to Regulation (EC) No 726/2004 of the European Parliament and of the Council (10), those who have received COVID-19 vaccines that have been granted a marketing authorisation by the competent authority of a Member State pursuant to Directive 2001/83/EC of the European Parliament and of the Council (11), and those who have received COVID-19 vaccines the distribution of which has been temporarily authorised pursuant to Article 5(2) of that Directive. ---|--- (30) | Persons who have been vaccinated before the date of application of this Regulation, including as part of a clinical trial, should also have the right to obtain a vaccination certificate in accordance with this Regulation given that the EU Digital COVID Certificate provides the mutually accepted framework to facilitate the exercise of the right to free movement. Where Union citizens or their family members are not in possession of a vaccination certificate that complies with the requirements of this Regulation, in particular because they have been vaccinated before the date of application of this Regulation, they should be given every reasonable opportunity to prove by other means that they should benefit from the waiving of relevant restrictions to free movement afforded by a Member State to holders of vaccination certificates issued pursuant to this Regulation. This should not be understood as affecting the obligation of Member States to issue vaccination certificates that comply with the requirements of this Regulation nor the right of Union citizens or their family members to receive, from Member States, such vaccination certificates. At the same time, Member States should remain free to issue proof of vaccination in other formats for other purposes, in particular for medical purposes. ---|--- (31) | Member States may also issue upon request vaccination certificates to persons who have been vaccinated in a third country and who provide all necessary information, including reliable proof to that effect. This is of particular importance to allow the persons concerned to make use of an interoperable and accepted vaccination certificate when exercising their right to free movement within the Union. This should apply in particular to Union citizens and their family members vaccinated in a third country for whom the health system of a Member State allows for the issuance of an EU Digital COVID Certificate and provided that the Member State has been provided with reliable proof of vaccination. A Member State should not be required to issue a vaccination certificate where the COVID-19 vaccine concerned is not authorised for use on its territory. There is no requirement for Member States to issue vaccination certificates at consular posts. ---|--- (32) | On 12 March 2021, the eHealth Network updated its Guidelines on Verifiable Vaccination Certificates - Basic Interoperability Elements. Those guidelines, in particular the preferred code standards, should form the basis for the technical specifications to be adopted for the purpose of this Regulation. ---|--- (33) | Before the date of application of this Regulation several Member States already exempted vaccinated persons from certain restrictions to free movement within the Union. Where Member States accept proof of vaccination in order to waive restrictions to free movement put in place, in accordance with Union law to limit the spread of SARS-CoV-2, such as a requirement to undergo quarantine or self-isolation or to be tested for SARS-CoV-2 infection, they should be required to accept, under the same conditions, vaccination certificates issued by other Member States in accordance with this Regulation. Such acceptance should take place under the same conditions, meaning that, for example, where a Member State considers a single dose of a vaccine administered to be sufficient, it should do so also for holders of a vaccination certificate indicating a single dose of the same vaccine. Where Member States lift restrictions to free movement on the basis of proof of vaccination, they should not subject vaccinated persons to additional restrictions to free movement linked to the COVID-19 pandemic, such as travel-related testing for SARS-CoV-2 infection or travel-related quarantine or self-isolation, unless such additional restrictions are, based on the latest available scientific evidence, necessary and proportionate for the purpose of safeguarding public health, and non-discriminatory. ---|--- (34) | Regulation (EC) No 726/2004 puts in place harmonised procedures, involving all Member States, for the authorisation and surveillance of medicinal products at Union level, ensuring that only high quality medicinal products are placed on the market and administered to persons throughout the Union. As a result, the marketing authorisations granted by the Union pursuant to that Regulation, including the underlying evaluation of the medicinal product concerned in terms of quality, safety and efficacy, are valid in all Member States. In addition, efficacy follow-up and supervision procedures of medicinal products authorised pursuant to that Regulation are carried out centrally for all Member States. The assessment and approval of vaccines via the centralised procedure follow shared standards and are done in a consistent way on behalf of all Member States. Participation of Member States in the review and endorsement of the assessment is ensured through various committees and groups. The assessment also benefits from the expertise of the European medicines regulatory network. The authorisation via the centralised procedure provides the confidence that all Member States can rely on the data on efficacy and safety and on the consistency of the batches being used for vaccination. The obligation to accept, under the same conditions, vaccination certificates issued by other Member States should therefore cover COVID-19 vaccines that have been granted a marketing authorisation pursuant to Regulation (EC) No 726/2004. In order to support the work of WHO and to strive for better global interoperability, Member States are in particular encouraged to accept vaccination certificates issued for other COVID-19 vaccines that have completed the WHO emergency use listing procedure. ---|--- (35) | Harmonised procedures under Regulation (EC) No 726/2004 should not prevent Member States from deciding to accept vaccination certificates issued for other COVID-19 vaccines that have been granted a marketing authorisation by the competent authority of a Member State pursuant to Directive 2001/83/EC, vaccines the distribution of which has been temporarily authorised pursuant to Article 5(2) of that Directive, and vaccines that have completed the WHO emergency use listing procedure. Where such a COVID-19 vaccine is subsequently granted a marketing authorisation pursuant to Regulation (EC) No 726/2004, the obligation to accept vaccination certificates under the same conditions would also cover vaccination certificates issued by a Member State for that COVID-19 vaccine, regardless of whether the vaccination certificates were issued before or after the authorisation via the centralised procedure. ---|--- (36) | It is necessary to prevent direct or indirect discrimination against persons who are not vaccinated, for example because of medical reasons, because they are not part of the target group for which the COVID -19 vaccine is currently administered or allowed, such as children, or because they have not yet had the opportunity or chose not to be vaccinated. Therefore, possession of a vaccination certificate, or the possession of a vaccination certificate indicating a COVID-19 vaccine, should not be a pre-condition for the exercise of the right to free movement or for the use of cross-border passenger transport services such as airlines, trains, coaches or ferries or any other means of transport. In addition, this Regulation cannot be interpreted as establishing a right or obligation to be vaccinated. ---|--- (37) | Many Member States have been requiring persons travelling to their territory to undergo a test for SARS-CoV-2 infection before or after arrival. At the beginning of the COVID-19 pandemic, Member States typically relied on reverse transcription polymerase chain reaction (RT-PCR), which is a nucleic acid amplification (NAAT) test for COVID-19 diagnostics considered by the WHO and the ECDC to be the most reliable methodology for the testing of cases and contacts. As the pandemic has progressed, a new generation of faster and cheaper tests has become available on the Union market, the so-called rapid antigen tests, which detect the presence of viral proteins (antigens) to detect an ongoing SARS-CoV-2 infection. Commission Recommendation (EU) 2020/1743 (12) sets out guidance for Member States regarding the use of such rapid antigen tests. ---|--- (38) | The Council Recommendation of 21 January 2021 (13) sets out a common framework for the use and validation of rapid antigen tests and the mutual recognition of COVID-19 test results in the Union and provides for the development of a common list of COVID-19 rapid antigen tests. On the basis of that Recommendation, the Health Security Committee agreed, on 18 February 2021, on a common list of COVID-19 rapid antigen tests, a selection of rapid antigen tests for which Member States will mutually recognise their results and a common standardised set of data to be included in COVID-19 test certificates. ---|--- (39) | Despite those common efforts, Union citizens and their family members exercising their right to free movement still face problems when trying to have the test result obtained in one Member State accepted in another. Those problems are often linked to the language in which the test result is issued, or to a lack of trust in the authenticity of the document shown. In that context, the cost of tests also needs to be taken into account. Such problems are aggravated for persons who cannot be vaccinated yet, in particular children, for whom test results may be the only way to travel where restrictions are in place. ---|--- (40) | To improve the level of acceptance of results of tests carried out in another Member State when presenting such results for the purpose of exercising the right to free movement, an interoperable test certificate should be established, containing the information necessary to clearly identify the holder as well as the type, date and result of the test for SARS-CoV-2 infection. To ensure the reliability of the test result, only the results of NAAT tests and rapid antigen tests featured in the list established on the basis of the Council Recommendation of 21 January 2021 should be eligible for a test certificate issued on the basis of this Regulation. The common standardised set of data to be included in test certificates agreed by the Health Security Committee on the basis of the Council Recommendation of 21 January 2021, in particular the preferred code standards, should form the basis for the technical specifications to be adopted for the purpose of this Regulation. ---|--- (41) | The use of rapid antigen tests would serve to facilitate the issuance of test certificates on an affordable basis. Universal, timely and affordable access to COVID-19 vaccines and tests for SARS-CoV-2 infection, which form the basis for the issuance of the certificates making up the EU Digital COVID Certificate, is crucial in the fight against the COVID-19 pandemic. Among other things, easy access to inexpensive rapid antigen tests meeting quality criteria can contribute to lower costs, in particular for persons who cross borders on a daily or other frequent basis for work or education, to visit close relatives, to seek medical care, or to take care of loved ones, for other travellers with an essential function or need, for economically disadvantaged persons and for students. On 11 May 2021, the Health Security Committee adopted an updated list of rapid antigen tests, increasing the number of rapid antigen tests recognised as meeting quality criteria to 83. Before the date of application of this Regulation, several Member States already provided large-scale testing possibilities to their populations. To support the testing capacity of Member States, the Commission has mobilised EUR 100 million to purchase over 20 million rapid antigen tests. EUR 35 million were also mobilised through an agreement with Red Cross to increase testing capacity in Member States through mobile testing capacities. ---|--- (42) | COVID-19 test certificates indicating a negative result issued by Member States in accordance with this Regulation should be accepted, under the same conditions, by Member States requiring proof of a test for SARS-CoV-2 infection in order to waive the restrictions to free movement put in place to limit the spread of SARS-CoV-2. Where the epidemiological situation allows, holders of test certificates indicating a negative result should not be subject to additional restrictions to free movement linked to the COVID-19 pandemic, such as additional travel-related testing for SARS-CoV-2 infection upon arrival or travel-related quarantine or self-isolation, unless such additional restrictions are, based on the latest available scientific evidence, necessary and proportionate for the purpose of safeguarding public health, and non-discriminatory. ---|--- (43) | According to existing scientific evidence, it is possible for persons who have recovered from COVID-19 to continue to test positive for SARS-CoV-2 for a certain period after the onset of symptoms. Where such persons are required to undergo a test prior to exercising their right to free movement, they could therefore be effectively prevented from travelling despite no longer being infectious. For the purpose of facilitating free movement, and to ensure that restrictions to free movement currently in place during the COVID-19 pandemic can be lifted in a coordinated manner based on the latest scientific evidence available, an interoperable certificate of recovery should be established, containing the information necessary to clearly identify the person concerned and the date of a previous positive test result for SARS-CoV-2 infection. A certificate of recovery should be issued at the earliest 11 days after the date on which the person was first subject to a NAAT test which produced a positive result and should be valid for not more than 180 days. According to the ECDC, recent evidence shows that despite shedding of viable SARS-CoV-2 between ten and twenty days from the onset of symptoms, convincing epidemiological studies have failed to show onward SARS-CoV-2 transmission after ten days. The Commission should be empowered to change that period on the basis of guidance from the Health Security Committee or from ECDC, which is closely studying the evidence base for the duration of acquired immunity after recovery. ---|--- (44) | Before the date of application of this Regulation, several Member States already exempted recovered persons from certain restrictions to free movement within the Union. Where Member States accept proof of recovery in order to waive restrictions to free movement put in place, in accordance with Union law, to limit the spread of SARS-CoV-2, such as a requirement to undergo quarantine or self-isolation or to be tested for SARS-CoV-2 infection, they should be required to accept, under the same conditions, certificates of recovery from COVID-19 issued by other Member States in accordance with this Regulation. On 15 March 2021, the eHealth Network, in cooperation with Health Security Committee, issued guidelines on COVID-19 citizen recovery interoperable certificates - minimum dataset. Where Member States lift restrictions to free movement on the basis of a certificate of recovery, they should not subject the recovered persons to additional restrictions to free movement linked to the COVID-19 pandemic, such as travel-related testing for SARS-CoV-2 infection or travel-related quarantine or self-isolation, unless such additional restrictions are, based on the latest available scientific evidence, necessary and proportionate for the purpose of safeguarding public health, and non-discriminatory. ---|--- (45) | To be able to obtain a common position quickly, the Commission should be able to ask the Health Security Committee, the ECDC or EMA to issue guidance on the available scientific evidence on the effects of medical events documented in the certificates established in accordance with this Regulation, including the effectiveness and duration of the immunity conferred by COVID-19 vaccines, whether vaccines prevent asymptomatic infection and SARS-CoV-2 transmission, the situation of people having recovered from COVID-19, and the impacts of the new SARS-CoV-2 variants on people who have been vaccinated or already infected. ---|--- (46) | In order to ensure uniform conditions for the implementation of the trust framework established by this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (14). ---|--- (47) | The Commission should adopt immediately applicable implementing acts where, in duly justified cases relating, in particular to the need to ensure a timely implementation of the trust framework, imperative grounds of urgency so require or when new scientific evidence becomes available. ---|--- (48) | Regulation (EU) 2016/679 of the European Parliament and of the Council (15) applies to the processing of personal data carried out when implementing this Regulation. This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records. Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects. Where the certificate is used for non-medical purposes, personal data accessed during the verification process are not to be retained, as provided for in this Regulation. ---|--- (49) | Where a Member State has adopted or adopts, on the basis of national law, a system of COVID-19 certificates for domestic purposes, it should ensure for the period of application of this Regulation that certificates making up the EU Digital COVID Certificate can also be used and are also accepted for domestic purposes, in order to avoid that persons travelling to another Member State and using the EU Digital COVID Certificate are obliged to obtain an additional national COVID-19 certificate. ---|--- (50) | In line with the principle of data minimisation, COVID-19 certificates should contain only the personal data strictly necessary for the purpose of facilitating the exercise of the right to free movement within the Union during the COVID-19 pandemic. The specific categories of personal data and data fields to be included in the COVID-19 certificates should be set out in this Regulation. ---|--- (51) | For the purposes of this Regulation, personal data on individual certificates do not need to be transmitted or exchanged across borders. In line with the public-key infrastructure approach, only the public keys of the issuers need to be transferred or accessed across borders, which will be ensured by an interoperability gateway set up and maintained by the Commission. In particular, the presence of the certificate combined with the public key of the issuer should allow for the verification of the authenticity, validity and integrity of the certificate. To prevent and detect fraud, Member States should be able to exchange lists of revoked certificates. In line with the principle of data protection by default, verification techniques not requiring transmission of personal data on individual certificates should be employed. ---|--- (52) | The retention of personal data obtained from the certificate by the Member State of destination or transit or by the cross-border passenger transport services operators required by national law to implement certain public health measures during the COVID-19 pandemic should be prohibited. This Regulation does not provide a legal basis for setting up or maintaining a centralised database at Union level containing personal data. ---|--- (53) | In accordance with Regulation (EU) 2016/679, the data controllers and processors of personal data are to take appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing. ---|--- (54) | The authorities or other designated bodies responsible for issuing the certificates making up the EU Digital COVID Certificate, as controllers within the meaning of Regulation (EU) 2016/679, are accountable for how they process personal data falling within the scope of this Regulation. This includes ensuring a level of security appropriate to the risks, including by establishing a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. The powers of the supervisory authorities established under Regulation (EU) 2016/679 apply in full, in order to protect natural persons in relation to the processing of their personal data. ---|--- (55) | To ensure coordination, the Commission and the other Member States should be informed when a Member State requires holders of certificates to undergo, after entry into its territory, quarantine or self-isolation or to be tested for SARS-CoV-2 infection, or if it imposes other restrictions on holders of such certificates. ---|--- (56) | Clear, comprehensive and timely communication to the public, including holders, on the purpose, issuance and acceptance of each type of the certificates making up the EU Digital COVID Certificate is crucial to ensure predictability for travel and legal certainty. The Commission should support the efforts of Member States in this regard, for example by making available the information provided by Member States on the ‘Re-open EU’ web platform. ---|--- (57) | A phasing-in period should be provided for, to give Member States which are unable to issue certificates in the format that complies with this Regulation from its date of application the possibility to continue issuing COVID-19 certificates which are not yet in compliance with this Regulation. During the phasing-in period, such COVID-19 certificates and COVID-19 certificates issued before the date of application of this Regulation should be accepted by Member States provided that they contain the necessary data. ---|--- (58) | In accordance with Recommendation (EU) 2020/1475, any restrictions to the free movement of persons within the Union put in place to limit the spread of SARS-CoV-2 should be lifted as soon as the epidemiological situation allows. This also applies to requirements to present documents other than those required by Union law, in particular Directive 2004/38/EC, such as the certificates covered by this Regulation. This Regulation should apply for 12 months from its date of application.

By four months after the date of application of this Regulation, the Commission should submit a report to the European Parliament and to the Council. At the latest three months before the end of the period of application of this Regulation, taking into account the evolution of the epidemiological situation with regard to the COVID-19 pandemic, the Commission should submit a second report to the European Parliament and the Council, on the lessons learned from the application of this Regulation, including on its impact on the facilitation of free movement and on data protection. ---|--- (59) | In order to take into account the scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to amend this Regulation by modifying or removing the data fields to be included in the EU Digital COVID Certificate regarding the identity of the holder, information about the COVID-19 vaccine, the test for SARS-CoV-2 infection, past SARS-CoV-2 infection and the certificate metadata, by adding data fields regarding information about the COVID-19 vaccine, the test for SARS-CoV-2 infection, past SARS-CoV-2 infection and certificate metadata and by amending the number of days after which a certificate of recovery is to be issued. In order to take into account guidance received, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to amend the provisions of this Regulation with regard to the certificate of recovery by providing for its issuance on the basis of a positive rapid antigen test, antibody test, including serological testing for antibodies against SARS-CoV-2, or any other scientifically reliable method. Such delegated acts should include the necessary data fields on the categories of data laid down by this Regulation to be included in the certificate of recovery. They should also contain specific provisions on the maximum validity period, which may depend on the type of the test carried out. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (16). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. ---|--- (60) | In accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council (17), the Commission is to consult the European Data Protection Supervisor when preparing delegated acts or implementing acts that impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The Commission may also consult the European Data Protection Board where such acts are of particular importance for the protection of rights and freedoms of individuals with regard to the processing of personal data. ---|--- (61) | Since the objective of this Regulation, namely to facilitate the exercise of the right to free movement within the Union during the COVID-19 pandemic by establishing a framework for the issuance, verification and acceptance of interoperable COVID-19 certificates on a person’s COVID-19 vaccination, test result or recovery, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective. ---|--- (62) | This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union (the ‘Charter’), including the right to respect for private and family life, the right to the protection of personal data, the right to equality before the law and non-discrimination, the freedom of movement and the right to an effective remedy. Member States are to comply with the Charter when implementing this Regulation. ---|--- (63) | Given the urgency of the situation related to the COVID-19 pandemic, this Regulation should enter into force on the day of its publication in the Official Journal of the European Union. ---|--- (64) | The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42 of Regulation (EU) 2018/1725 and delivered a joint opinion on 31 March 2021 (18), ---|--- HAVE ADOPTED THIS REGULATION: Article 1 Subject matter This Regulation lays down a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) for the purpose of facilitating the holders’ exercise of their right to free movement during the COVID-19 pandemic. This Regulation shall also contribute to facilitating the gradual lifting of restrictions to free movement put in place by the Member States, in accordance with Union law, to limit the spread of SARS-CoV-2, in a coordinated manner. It provides for the legal ground to process the personal data necessary to issue such certificates and to process the information necessary to verify and confirm the authenticity and validity of such certificates in full compliance with Regulation (EU) 2016/679. Article 2 Definitions For the purposes of this Regulation, the following definitions apply: (1) | ‘holder’ means a person to whom an interoperable certificate containing information about that person’s COVID-19 vaccination, test result or recovery has been issued in accordance with this Regulation; ---|--- (2) | ‘EU Digital COVID Certificate’ means interoperable certificates containing information about the vaccination, test result or recovery of the holder issued in the context of the COVID-19 pandemic; ---|--- (3) | ‘COVID-19 vaccine’ means an immunological medicinal product indicated for active immunisation to prevent COVID-19 caused by SARS-CoV-2; ---|--- (4) | ‘NAAT test’ means a molecular nucleic acid amplification test, such as reverse transcription polymerase chain reaction (RT-PCR), loop-mediated isothermal amplification (LAMP) and transcription-mediated amplification (TMA) techniques, used to detect the presence of the SARS-CoV-2 ribonucleic acid (RNA); ---|--- (5) | ‘rapid antigen test’ means a test that relies on detection of viral proteins (antigens) using a lateral flow immunoassay that gives results in less than 30 minutes; ---|--- (6) | ‘antibody test’ means a laboratory-based test aiming to detect if a person has developed antibodies against SARS-CoV-2, thus indicating that the holder has been exposed to SARS-CoV-2 and has developed antibodies, regardless of whether that person was symptomatic; ---|--- (7) | ‘interoperability’ means the capability of verifying systems in a Member State to use data encoded by another Member State; ---|--- (8) | ‘barcode’ means a method of storing and representing data in a visual, machine-readable format; ---|--- (9) | ‘electronic seal’ means electronic seal as defined in point (25) of Article 3 of Regulation (EU) No 910/2014; ---|--- (10) | ‘unique certificate identifier’ means a unique identifier given, in accordance with a common structure, to each certificate issued in accordance with this Regulation; ---|--- (11) | ‘trust framework’ means the rules, policies, specifications, protocols, data formats and digital infrastructure regulating and allowing for the reliable and secure issuance and verification of certificates to ensure their trustworthiness by confirming their authenticity, validity and integrity, through the use of electronic seals. ---|--- Article 3 EU Digital COVID Certificate 1\. The EU Digital COVID Certificate framework shall allow for the issuance, cross-border verification and acceptance of any of the following certificates: (a) | a certificate confirming that the holder has received a COVID-19 vaccine in the Member State issuing the certificate (vaccination certificate); ---|--- (b) | a certificate confirming that the holder has been subject to a NAAT test or a rapid antigen test listed in the common and updated list of COVID-19 rapid antigen tests established on the basis of the Council Recommendation of 21 January 2021 carried out by health professionals or by skilled testing personnel in the Member State issuing the certificate and indicating the type of test, the date on which it was carried out and the result of the test (test certificate); ---|--- (c) | a certificate confirming that, following a positive result of a NAAT test carried out by health professionals or by skilled testing personnel the holder has recovered from a SARS-CoV-2 infection (certificate of recovery). ---|--- The Commission shall publish the list of COVID-19 rapid antigen tests established on the basis of the Council Recommendation of 21 January 2021, including any updates. 2\. Member States, or designated bodies acting on behalf of Member States, shall issue the certificates referred to in paragraph 1 of this Article in a digital or paper-based format, or both. The prospective holders shall be entitled to receive the certificates in the format of their choice. Those certificates shall be user-friendly and shall contain an interoperable barcode allowing for the verification of their authenticity, validity and integrity. The barcode shall comply with the technical specifications established pursuant to Article 9. The information contained in the certificates shall also be shown in human-readable form and shall be provided in at least the official language or languages of the issuing Member State and English. 3\. A separate certificate shall be issued for each vaccination, test result or recovery. Such a certificate shall not contain data from previous certificates except where otherwise provided for in this Regulation. 4\. The certificates referred to in paragraph 1 shall be issued free of charge. The holder shall be entitled to request the issuance of a new certificate if the personal data contained in the original certificate are not or are no longer accurate or up to date, including with regard to the vaccination, test result or recovery of the holder, or if the original certificate is no longer available to the holder. Appropriate fees may be charged for the issuance of a new certificate in cases of repeated loss. 5\. The certificates referred to in paragraph 1 shall include the following text: ‘This certificate is not a travel document. The scientific evidence on COVID-19 vaccination, testing and recovery continues to evolve, including with regard to new virus variants of concern. Before travelling, please check the applicable public health measures and related restrictions applicable at the point of destination.’ Member States shall provide the holder with clear, comprehensive and timely information on the issuance and purpose of vaccination certificates, test certificates, or certificates of recovery for the purposes of this Regulation. 6\. Possession of the certificates referred to in paragraph 1 shall not be a precondition for exercising the right to free movement. 7\. The issuance of certificates pursuant to paragraph 1 of this Article shall not lead to discrimination on the basis of the possession of a specific category of certificate as referred to in Article 5, 6 or 7. 8\. Issuance of the certificates referred to in paragraph 1 shall not affect the validity of any other proof of vaccination, test result or recovery issued before 1 July 2021 or for other purposes, in particular for medical purposes. 9\. Cross-border passenger transport service operators required by national law to implement certain public health measures during the COVID-19 pandemic shall ensure that the verification of the certificates referred in paragraph 1 is integrated into the operation of cross-border transport infrastructure such as airports, ports and railway and bus stations, where appropriate. 10\. The Commission may adopt implementing acts establishing that COVID-19 certificates issued by a third country with which the Union and the Member States have concluded an agreement on the free movement of persons allowing the contracting parties to restrict such free movement on grounds of public health in a non-discriminatory manner and which does not contain a mechanism of incorporation of Union legal acts are equivalent to those issued in accordance with this Regulation. Where the Commission adopts such implementing acts, the certificates concerned shall be accepted under the conditions referred to in Article 5(5), Article 6(5) and Article 7(8). Before adopting such implementing acts, the Commission shall assess whether such a third country issues certificates equivalent to those issued in accordance with this Regulation and has provided formal assurances that it will accept certificates issued by the Member States. The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 14(2). 11\. Where necessary, the Commission shall ask the Health Security Committee, the ECDC or EMA to issue guidance on the available scientific evidence on the effects of medical events documented in the certificates referred to in paragraph 1, in particular with regard to new SARS-CoV-2 variants of concern. Article 4 Trust framework for the EU Digital COVID Certificate 1\. The Commission and the Member States shall set up and maintain a trust framework for the EU Digital COVID Certificate. 2\. The trust framework shall be based on a public key infrastructure and allow for the reliable and secure issuance and verification of the authenticity, validity and integrity of the certificates referred to in Article 3(1). The trust framework shall allow for the detection of fraud, in particular forgery. In addition, it may support the bilateral exchange of certificate revocation lists containing the unique certificate identifiers of revoked certificates. Such certificate revocation lists shall not contain any other personal data. The verification of the certificates referred to in Article 3(1) and, where applicable, certificate revocation lists shall not give rise to the issuer being notified of the verification. 3\. The trust framework shall seek to ensure interoperability with technological systems established at international level. Article 5 Vaccination certificate 1\. Each Member State shall, automatically or upon request by the persons concerned, issue the vaccination certificates referred to in point (a) of Article 3(1) to persons to whom a COVID-19 vaccine has been administered. Those persons shall be informed of their right to a vaccination certificate. 2\. The vaccination certificate shall contain the following categories of personal data: (a) | the identity of the holder; ---|--- (b) | information about the COVID-19 vaccine and the number of doses administered to the holder; ---|--- (c) | certificate metadata, such as the certificate issuer or a unique certificate identifier. ---|--- The personal data shall be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the Annex. The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend point 1 of the Annex by modifying or removing data fields, or by adding data fields falling under the categories of personal data referred to in points (b) and (c) of the first subparagraph of this paragraph, where such an amendment is necessary to verify and confirm the authenticity, validity and integrity of the vaccination certificate, in the case of scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards. 3\. The vaccination certificate shall be issued in a secure and interoperable format in accordance with Article 3(2) after the administration of each dose and shall clearly indicate whether or not the vaccination course has been completed. 4\. Where, in the case of newly emerging scientific evidence or to ensure interoperability with international standards and technological systems, imperative grounds of urgency so require, the procedure provided for in Article 13 shall apply to delegated acts adopted pursuant to this Article. 5\. Where Member States accept proof of vaccination in order to waive restrictions to free movement put in place, in accordance with Union law, to limit the spread of SARS-CoV-2, they shall also accept, under the same conditions, vaccination certificates issued by other Member States in accordance with this Regulation for a COVID-19 vaccine that has been granted a marketing authorisation pursuant to Regulation (EC) No 726/2004. Member States may also accept, for the same purpose, vaccination certificates issued by other Member States in accordance with this Regulation for a COVID-19 vaccine that has been granted a marketing authorisation by the competent authority of a Member State pursuant to Directive 2001/83/EC, a COVID-19 vaccine the distribution of which has been temporarily authorised pursuant to Article 5(2) of that Directive, or a COVID-19 vaccine that has completed the WHO emergency use listing procedure. Where Member States accept vaccination certificates for a COVID-19 vaccine referred to in the second subparagraph, they shall also accept, under the same conditions, vaccination certificates issued by other Member States in accordance with this Regulation for the same COVID-19 vaccine. Article 6 Test certificate 1\. Each Member State shall, automatically or upon request by the persons concerned, issue the test certificates referred to in point (b) of Article 3(1) to persons tested for SARS-CoV-2 infection. Those persons shall be informed of their right to a test certificate. 2\. The test certificate shall contain the following categories of personal data: (a) | the identity of the holder; ---|--- (b) | information about the NAAT test or rapid antigen test to which the holder was subject; ---|--- (c) | certificate metadata, such as the certificate issuer or a unique certificate identifier. ---|--- The personal data shall be included in the test certificate in accordance with the specific data fields set out in point 2 of the Annex. The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend point 2 of the Annex by modifying or removing data fields, or by adding data fields falling under the categories of personal data referred to in points (b) and (c) of the first subparagraph of this paragraph, where such an amendment is necessary to verify and confirm the authenticity, validity and integrity of the test certificate, in the case of scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards. 3\. The test certificate shall be issued in a secure and interoperable format in accordance with Article 3(2). 4\. Where, in the case of newly emerging scientific evidence or to ensure interoperability with international standards and technological systems, imperative grounds of urgency so require, the procedure provided for in Article 13 shall apply to delegated acts adopted pursuant to this Article. 5\. Where Member States require proof of a test for SARS-CoV-2 infection in order to waive the restrictions to free movement put in place, in accordance with Union law and taking into account the specific situation of cross-border communities, to limit the spread of SARS-CoV-2, they shall also accept, under the same conditions, test certificates indicating a negative result issued by other Member States in accordance with this Regulation. Article 7 Certificate of recovery 1\. Each Member State shall issue, upon request, the certificates of recovery referred to in point (c) of Article 3(1). Certificates of recovery shall be issued at the earliest 11 days after the date on which a person was first subject to a NAAT test which produced a positive result. The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend the number of days after which a certificate of recovery is to be issued, on the basis of guidance received from the Health Security Committee in accordance with Article 3(11) or on scientific evidence reviewed by ECDC. 2\. The certificate of recovery shall contain the following categories of personal data: (a) | the identity of the holder; ---|--- (b) | information about past SARS-CoV-2 infection of the holder following a positive test result; ---|--- (c) | certificate metadata, such as the certificate issuer or a unique certificate identifier. ---|--- The personal data shall be included in the certificate of recovery in accordance with the specific data fields set out in point 3 of the Annex. The Commission is empowered to adopt delegated acts in accordance with Article 12 to amend point 3 of the Annex by modifying or removing data fields, or by adding data fields falling under categories of personal data referred to in points (b) and (c) of the first subparagraph of this paragraph, where such an amendment is necessary to verify and confirm the authenticity, validity and integrity of the certificate of recovery, in the case of scientific progress in containing the COVID-19 pandemic, or to ensure interoperability with international standards. 3\. The certificate of recovery shall be issued in a secure and interoperable format in accordance with Article 3(2). 4\. On the basis of guidance received pursuant to Article 3(11), the Commission is empowered to adopt delegated acts in accordance with Article 12 to amend paragraph 1 of this Article and point (c) of Article 3(1) to allow for the issuance of the certificate of recovery on the basis of a positive rapid antigen test, antibody test, including a serological test for antibodies against SARS-CoV-2, or any other scientifically validated method. Such delegated acts shall also amend point 3 of the Annex by adding, modifying or removing the data fields falling under the categories of personal data referred to in points (b) and (c) of paragraph 2 of this Article. 5\. Following the adoption of the delegated acts referred to in paragraph 4 the Commission shall publish the list of antibody tests on the basis of which a certificate of recovery may be issued, which is to be established by the Health Security Committee, including any updates. 6\. In the report provided for in Article 16(1), the Commission shall assess the appropriateness and feasibility, in light of the available scientific evidence, of adopting the delegated acts referred to in paragraph 4 of this Article. Before submitting that report, the Commission shall seek regular guidance pursuant to Article 3(11) on the available scientific evidence and level of standardisation regarding the possible issuance of certificates of recovery based on antibody tests, including serological testing for antibodies against SARS-CoV-2,, taking into account the availability and accessibility of such tests. 7\. Where, in the case of newly emerging scientific evidence or to ensure interoperability with international standards and technological systems, imperative grounds of urgency so require, the procedure provided for in Article 13 shall apply to delegated acts adopted pursuant to this Article. 8\. Where Member States accept proof of recovery from SARS-CoV-2 infection in order to waive restrictions to free movement put in place, in accordance with Union law, to limit the spread of SARS-CoV-2, they shall accept, under the same conditions, certificates of recovery issued by other Member States in accordance with this Regulation. Article 8 COVID-19 certificates and other documentation issued by a third country 1\. Where a vaccination certificate has been issued in a third country for a COVID-19 vaccine that corresponds to one of the COVID-19 vaccines referred to Article 5(5) and the authorities of a Member State have been provided with all the necessary information, including reliable proof of vaccination, those authorities may, upon request, issue a vaccination certificate as referred to in point (a) of Article 3(1) to the person concerned. A Member State shall not be required to issue a vaccination certificate for a COVID-19 vaccine that is not authorised for use on its territory. 2\. The Commission may adopt an implementing act establishing that COVID-19 certificates issued by a third country in accordance with standards and technological systems that are interoperable with the trust framework for the EU Digital COVID Certificate and that allow for the verification of the authenticity, validity and integrity of the certificate, and which contain the data set out in the Annex, are to be considered as equivalent to certificates issued by Member States in accordance with this Regulation, for the purpose of facilitating the holders’ exercise of their right to free movement within the Union. Before adopting such an implementing act, the Commission shall assess whether COVID-19 certificates issued by the third country fulfil the conditions set out in the first subparagraph. The implementing act referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 14(2). The Commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. 3\. The acceptance by the Member States of the certificates referred to in this Article shall be subject to Article 5(5), Article 6(5) and Article 7(8). 4\. Where Member States accept vaccination certificates issued by a third country for a COVID-19 vaccine as referred to in the second subparagraph of Article 5(5), they shall also accept, under the same conditions, vaccination certificates issued by other Member States in accordance with this Regulation for the same COVID-19 vaccine. 5\. This Article shall apply to COVID-19 certificates and other documentation issued by the overseas countries and territories referred to in Article 355(2) TFEU and listed in Annex II thereto, and by the Faroe Islands. It shall not apply to COVID-19 certificates and other documentation issued in the overseas countries and territories referred to in Article 355(2) TFEU and listed in Annex II thereto, or in the Faroe Islands on behalf of a Member State. Article 9 Technical specifications 1\. In order to ensure uniform conditions for the implementation of the trust framework established by this Regulation, the Commission shall adopt implementing acts containing the technical specifications and rules for the purpose of: (a) | securely issuing and verifying the certificates referred to Article 3(1); ---|--- (b) | ensuring the security of personal data, taking into account the nature of the data; ---|--- (c) | populating the certificates referred to Article 3(1), including the coding system and any other relevant elements; ---|--- (d) | laying down the common structure of the unique certificate identifier; ---|--- (e) | issuing a valid, secure and interoperable barcode; ---|--- (f) | seeking to ensure interoperability with international standards and technological systems; ---|--- (g) | allocating responsibilities among controllers and as regards processors, in accordance with Chapter IV of Regulation (EU) 2016/679. ---|--- (h) | ensuring accessibility for persons with disabilities to the human-readable information contained in the digital certificate and in the paper-based certificate in accordance with the accessibility requirements under Union law. ---|--- 2\. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 14(2). 3\. On duly justified imperative grounds of urgency, in particular to ensure a timely implementation of the trust framework, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 14(3). Implementing acts adopted pursuant to this paragraph shall remain in force for the period of the application of this Regulation. Article 10 Protection of personal data 1\. Regulation (EU) 2016/679 shall apply to the processing of personal data carried out when implementing this Regulation. 2\. For the purpose of this Regulation, the personal data contained in the certificates issued pursuant to this Regulation shall be processed only for the purpose of accessing and verifying the information included in the certificate in order to facilitate the exercise of the right of free movement within the Union during the COVID-19 pandemic. After the end of period of the application of this Regulation, no further processing shall occur. 3\. The personal data included in the certificates referred to in Article 3(1) shall be processed by the competent authorities of the Member State of destination or transit, or by the cross-border passenger transport services operators required by national law to implement certain public health measures during the COVID-19 pandemic, only to verify and confirm the holder’s vaccination, test result or recovery. To that end, the personal data shall be limited to what is strictly necessary. The personal data accessed pursuant to this paragraph shall not be retained. 4\. The personal data processed for the purpose of issuing the certificates referred to in Article 3(1), including the issuance of a new certificate, shall not be retained by the issuer longer than is strictly necessary for its purpose and in no case longer than the period for which the certificates may be used to exercise the right to free movement. 5\. Any certificate revocation lists exchanged between Member States pursuant to Article 4(2) shall not be retained after the end of period of the application of this Regulation. 6\. The authorities or other designated bodies responsible for issuing the certificates referred to in Article 3(1) shall be considered to be controllers as defined in point (7) of Article 4 of Regulation (EU) 2016/679. 7\. The natural or legal person, public authority, agency or other body that has administered a COVID-19 vaccine or carried out the test for which a certificate is to be issued shall transmit to the authorities or other designated bodies responsible for issuing the certificates the personal data necessary to complete the data fields set out in the Annex. 8\. Where a controller as referred to in paragraph 6 uses a processor for the purposes referred to in Article 28(3) of Regulation (EU) 2016/679, no transfer of personal data by the processor to a third country shall take place. Article 11 Restrictions to free movement and information exchange 1\. Without prejudice to Member States’ competence to impose restrictions on grounds of public health, where Member States accept vaccination certificates, test certificates indicating a negative result or certificates of recovery, they shall refrain from imposing additional restrictions to free movement, such as additional travel-related testing for SARS-CoV-2 infection or travel- related quarantine or self-isolation, unless they are necessary and proportionate for the purpose of safeguarding public health in response to the COVID-19 pandemic, also taking into account available scientific evidence, including epidemiological data published by the ECDC on the basis of Recommendation (EU) 2020/1475. 2\. Where a Member State requires, in accordance with Union law, holders of the certificates referred to in Article 3(1) to undergo, after entry into its territory, quarantine or self-isolation or to be tested for SARS-CoV-2 infection, or if it imposes other restrictions on the holders of such certificates because, for example, the epidemiological situation in a Member State or in a region within a Member State worsens quickly, in particular as a result of a SARS-CoV-2 variant of concern or interest, it shall inform the Commission and the other Member States accordingly, if possible 48 hours in advance of the introduction of such new restrictions. To that end, the Member State shall provide the following information: (a) | the reasons for such restrictions; ---|--- (b) | the scope of such restrictions, specifying which certificate holders are subject to or exempt from such restrictions; ---|--- (c) | the date and duration of such restrictions. ---|--- 3\. Member States shall inform the Commission and the other Member States of the issuance and the conditions of acceptance of the certificates referred to in Article 3(1), including the COVID-19 vaccines they accept pursuant to the second subparagraph of Article 5(5). 4\. Member States shall provide the public with clear, comprehensive and timely information with regard to paragraphs 2 and 3. As a general rule, Member States shall make that information publicly available 24 hours before new restrictions come into effect, taking into account that some flexibility is required for epidemiological emergencies. In addition, the information provided by the Member States may be made publicly available by the Commission in a centralised manner. Article 12 Exercise of the delegation 1\. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2\. The power to adopt delegated acts referred to in Article 5(2), Article 6(2) and Article 7(1) and (2) shall be conferred on the Commission for a period of 12 months from 1 July 2021. 3\. The delegation of power referred to in Article 5(2), Article 6(2) and Article 7(1) and (2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4\. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5\. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6\. A delegated act adopted pursuant to Article 5(2), Article 6(2) or Article 7(1) or (2) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council. Article 13 Urgency procedure 1\. Delegated acts adopted under this Article shall enter into force without delay and shall apply as long as no objection is expressed in accordance with paragraph 2. The notification of a delegated act to the European Parliament and to the Council shall state the reasons for the use of the urgency procedure. 2\. Either the European Parliament or the Council may object to a delegated act in accordance with the procedure referred to in Article 11(6). In such a case, the Commission shall repeal the act immediately following the notification of the decision to object by the European Parliament or by the Council. Article 14 Committee procedure 1\. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2\. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. 3\. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply. Article 15 Phasing-in period 1\. COVID-19 certificates issued by a Member State before 1 July 2021 shall be accepted by the other Member States until 12 August 2021 in accordance with Article 5(5), Article 6(5) and Article 7(8), where they contain the data set out in the Annex. 2\. Where a Member State is not able to issue the certificates referred to in Article 3(1) in a format that complies with this Regulation from 1 July 2021, it shall inform the Commission and the other Member States accordingly. Where they contain the data set out in the Annex, the COVID-19 certificates issued by such a Member State in a format that does not comply with this Regulation shall be accepted by the other Member States in accordance with Article 5(5), Article 6(5) and Article 7(8) until 12 August 2021. Article 16 Commission reports 1\. By 31 October 2021, the Commission shall submit a report to the European Parliament and to the Council. The report shall include an overview of: (a) | the number of certificates issued pursuant to this Regulation; ---|--- (b) | guidance requested pursuant to Article 3(11) on the available scientific evidence and level of standardisation regarding the possible issuance of certificates of recovery based on antibody tests, including serological testing for antibodies against SARS-CoV-2, taking into account the availability and accessibility of such tests; and ---|--- (c) | the information received pursuant to Article 11. ---|--- 2\. By 31 March 2022, the Commission shall submit a report to the European Parliament and to the Council on the application of this Regulation. The report shall contain, in particular, an assessment of the impact of this Regulation on the facilitation of free movement, including on travel and tourism and the acceptance of the different types of vaccine, fundamental rights and non-discrimination, as well as on the protection of personal data during the COVID-19 pandemic. The report may be accompanied by legislative proposals, in particular to extend the period of application of this Regulation, taking into account the evolution of the epidemiological situation with regard to the COVID-19 pandemic. Article 17 Entry into force This Regulation shall enter into force on the day of its publication in the Official Journal of the European Union. It shall apply from 1 July 2021 to 30 June 2022. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 14 June 2021. For the European Parliament The President D. M. SASSOLI For the Council The President A. COSTA * * * (1) Opinion of 27 April 2021 (not yet published in the Official Journal). (2) Position of the European Parliament of 9 June 2021 (not yet published in the Official Journal) and decision of the Council of 11 June 2021. (3) Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (OJ L 158, 30.4.2004, p. 77). (4) Council Recommendation (EU) 2020/1475 of 13 October 2020 on a coordinated approach to the restriction of free movement in response to the COVID-19 pandemic (OJ L 337, 14.10.2020, p. 3). (5) Regulation (EU) 2021/954 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID 19 vaccination, test and recovery certificates (EU Digital COVID Certificate) with regard to third-country nationals legally staying or residing in the territories of Member States during the COVID 19 pandemic (See page 24 of this Official Journal). (6) Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) (OJ L 77, 23.3.2016, p. 1). (7) Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73). (8) Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45). (9) Decision No 1082/2013/EU of the European Parliament and of the Council of 22 October 2013 on serious cross-border threats to health and repealing Decision No 2119/98/EC (OJ L 293, 5.11.2013, p. 1). (10) Regulation (EC) No 726/2004 of the European Parliament and of the Council of 31 March 2004 laying down Union procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency (OJ L 136, 30.4.2004, p. 1). (11) Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the Community code relating to medicinal products for human use (OJ L 311, 28.11.2001, p. 67). (12) Commission Recommendation (EU) 2020/1743 of 18 November 2020 on the use of rapid antigen tests for the diagnosis of SARS-CoV-2 infection (OJ L 392, 23.11.2020, p. 63). (13) Council Recommendation of 21 January 2021 on a common framework for the use and validation of rapid antigen tests and the mutual recognition of COVID-19 test results in the EU (OJ C 24, 22.1.2021, p. 1). (14) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13). (15) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). (16) OJ L 123, 12.5.2016, p. 1. (17) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). (18) Not yet published in the Official Journal. * * * ANNEX CERTIFICATE DATASETS 1. | Data fields to be included in the vaccination certificate: | (a) | name: surname(s) and forename(s), in that order; ---|--- (b) | date of birth; ---|--- (c) | disease or agent targeted: COVID-19 (SARS-CoV-2 or one of its variants); ---|--- (d) | COVID-19 vaccine or prophylaxis; ---|--- (e) | COVID-19 vaccine product name; ---|--- (f) | COVID-19 vaccine marketing authorisation holder or manufacturer; ---|--- (g) | number in a series of doses as well as the overall number of doses in the series; ---|--- (h) | date of vaccination, indicating the date of the latest dose received; ---|--- (i) | Member State or third country in which the vaccine was administered; ---|--- (j) | certificate issuer; ---|--- (k) | unique certificate identifier. ---|--- 2. | Data fields to be included in the test certificate: | (a) | name: surname(s) and forename(s), in that order; ---|--- (b) | date of birth; ---|--- (c) | disease or agent targeted: COVID-19 (SARS-CoV-2 or one of its variants); ---|--- (d) | the type of test; ---|--- (e) | test name (optional for NAAT test); ---|--- (f) | test manufacturer (optional for NAAT test); ---|--- (g) | date and time of the test sample collection; ---|--- (h) | result of the test; ---|--- (i) | testing centre or facility (optional for rapid antigen test); ---|--- (j) | Member State or third country in which the test was carried out; ---|--- (k) | certificate issuer; ---|--- (l) | unique certificate identifier. ---|--- 3. | Data fields to be included in the certificate of recovery: | (a) | name: surname(s) and forename(s), in that order; ---|--- (b) | date of birth; ---|--- (c) | disease or agent from which the holder has recovered: COVID-19 (SARS-CoV-2 or one of its variants); ---|--- (d) | date of the holder’s first positive NAAT test result; ---|--- (e) | Member State or third country in which test was carried out; ---|--- (f) | certificate issuer; ---|--- (g) | certificate valid from; ---|--- (h) | certificate valid until (not more than 180 days after the date of first positive NAAT test result); ---|--- (i) | unique certificate identifier. ---|--- * * *