Alexia Pato
email: alexia.pato@bluewin.ch

COVID-19 Vaccination and Data Protection Issues: A European Comparative Study with Focuses on France

Keywords: Covid-19, vaccination, data protection, European Union, EU Member States, European Court of Human Rights, World Health Organisation

This report, which tackles data protection issues related to Covid-19 vaccinations, completes the study on vaccination policies carried out by the Max Planck Institute Luxembourg upon the request, and for the benefit of, the Ministry of Health of Luxembourg.

Executive Summary

This report, which tackles data protection issues related to Covid-19 vaccinations, completes the study on vaccination policies carried out by the Max Planck Institute Luxembourg upon the request, and for the benefit of, the Ministry of Health of Luxembourg. 1 The first part of this research project analyses the safeguard measures and guarantees put in place for the processing of data related to Covid-19 vaccinations in the EU. The general framework on data protection, i.e. the GDPR, is examined and relevant references to the law of the Council of Europe and the main recommendations at the European level are made. The purpose of this first part is to assess what EU Member States should do and what room for manoeuvre is left to those for the processing of data generated as a result of the Covid-19 vaccinations.

The main findings of the first part are:

 The processing of data related to Covid-19 vaccinations should be based on Art. 9 (2) (i) GDPR, according to which the processing of data concerning health is exceptionally allowed in case it is necessary for reasons of public interest in the area of public health, such as protecting serious cross-border treats to health.

 This type of processing requires specific safeguard measures from Member States in order to respect the professional secrecy and more globally the rights and freedoms of the data subject.

 As the Covid-19 vaccination campaigns imply the processing of sensitive personal data at large scale with high data risks, a data protection impact assessment is required according to Art.

GDPR.

 According to Art. 9 (4) GDPR, further national specifications can be adopted by Member States and Art. 23 (1) (e) GDPR allows restrictions to data protection principles and data subject rights in order to safeguard "(…) other important objectives of general public interest of the Union or of a Member State including public health (…)". These national restrictions shall:

o be based on EU or domestic Law;

o respect the essence of the fundamental rights and freedoms;

o be necessary and proportionate measures in a democratic society.

The second part of the research project consists in a comparative analysis of the data protection laws in the area of public health in France, Belgium, Germany and Switzerland with specific references to

Covid-19 vaccinations. The purpose of this second part is to understand and compare the approach taken in the selected States.

The main findings of the second part are:

 All the studied EU States created data bases for the processing of data related to the Covid-19 vaccinations based on an act of their government, which defined the controllers, the purposes, the categories of data collected, the recipients, the data subjects' rights and the period of retention of the data.

 All these national legal grounds for the processing of Covid-19 vaccination-related data raised concerns regarding the controller and the recipients in relation to the purposes of their processing not being defined precisely enough.

 The impact of the invalidation of the Privacy Shield has not been taken seriously into account.

A clear obligation of hosting the data in the EU should be introduced.

Introduction

In 2020, governments had to rapidly respond to the outbreak of the Covid-19 pandemic. Therefore, they experimented with several digital solutions which raised numerous data protection and privacy concerns uses of the contact tracing app, drones, thermal scans, smart cameras, e-bracelet, etc. In this unprecedented context, the pandemic is often seen both as a challenge to the resilience of the European model of data protection and as an opportunity to challenge such resilience. The first reports are mixed 2 and attest, once again, the gap between "law in the books" and "law in action". 2021 opens with the setting-up of the Covid-19 vaccination at a worldwide scale. This could be the opportunity to make a turning point in the development of a common European health data space, which is already a part of the European Commission's strategy on data3 . Infrastructures of cross-border exchange of health data could be created as suggested recently by the Greek initiative for a European certificate of Covid-19 vaccination. However, the implementation of such an idea raises many concerns at this stage.

The first need is to secure the processing of data related to the Covid-19 vaccination. This report aims at listing the main issues related to data protection in the context of the Covid-19 vaccination.

The first part of this research project analyses the kind of safeguard measures and guarantees that need to be adopted in order to ensure the appropriate processing of data related to the Covid-19 vaccination in Europe. The general framework applicable to the processing of health data, i. o processing in order to select the person who can be vaccinated;

o processing in order to obtain an appointment in a vaccination centre;

o processing for managing the secondary effects of the vaccine;

o processing for research purposes on the Covid-19 virus;

o processing that proves that the person is vaccinated.

 The law shall detail very carefully the purposes of the processing, the categories of data concerned, the controller and possibly the processor, the recipients, the rights of the data subjects and their potential limitations, the retention period and who can have access to these data, clarifying the conditions of the access in each case.

 Due to the invalidation of the Privacy Shield, it is highly recommended to secure and clarify that no data, in particular the ones related to health, shall be transferred outside the EU.

A.3 Detailed Analysis

A.3.1. The Processing of Personal Data Concerning Health According to the GDPR

The broad definition of processing. According to Art. 4 (2) GDPR "processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".

The broad definition of personal data concerning health. The GDPR 4 provides the first harmonised definition of the concept of processing of personal data concerning health. Article 4 (15) GDPR defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status".

In other words, data concerning health generally refers to personal data that have a link with the health status of a person. This new definition5 is a broad one, which does not explicitly require that the data be related to a pathology or disease. Therefore, data concerning health includes care data. Art. 4 (15) GDPR does not require processing by a health professional. Beyond medical data, it may also include administrative and financial data (such as medical appointments scheduling, invoices for healthcare service provision, indication of the number of days of sick leave, or sick leave management). The data concerning health can be processed by a medical device or by the Internet of Thing. Recital 35 GDPD also clarifies that data concerning health concerns "information relating to the past, current or future physical or mental health status of the data subject" (emphasis added). Still according to recital 35 GDPR, "this includes information about the natural person collected in the course of the registration for, or the provision of, health care services as referred to in Directive 2011/24/EU of the European Parliament and of the Council to that natural person; a number, symbol or particular assigned to a natural person to uniquely identify the natural person for health purposes; information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device or an in vitro diagnostic test".

Despite this harmonised definition, there is still some debate about the scope of the concept of data related to health. In practice, the line separating data related to heath from information of health that does not reveal the health status of a data subject can be blurred. 6 The following tripartite classification of health data is often suggested: (1) data related to heath per nature, such as medical and care data, mentioned in particular in recital 35 GPDR;

(2) data related to heath which in conjunction with other data, reveals the health status of a data subject;

(3) the use of data in the medical area can lead to the qualification of the data as data related to health.7

Processing during the Covid-19 vaccination. Different kinds of processing of personal data concerning health can occur during the Covid-19 vaccination. In particular:

 processing in order to select the person who can be vaccinated; 10  processing in order to obtain an appointment in a vaccination centre;

 processing for managing the secondary effects of the vaccine;

 processing for research purposes on the Covid-19 virus;

 processing that proves that the person is vaccinated.

A.3.2. The Conditions Justifying the Processing of Personal Data Concerning Health

The need of a clear legal ground for the processing. Art. 9 GDPR provides a general framework for the processing of so-called sensitive data, which includes data concerning health. Even though the processing of sensitive data is prohibited as a general rule, Art. 9 (2) GDPR provides a list of ten limited legal grounds that justify the processing of special categories of personal data. For the sake of this study, only the most relevant legal grounds are analysed.

Explicit consent as a valid but precarious legal ground. Art. 9 (2) (a) GDPR allows the processing of data concerning health when it is based on the explicit consent of the data subject. The WP29 has provided guidelines on consent under the GDPR. 8 Consent under the GDPR always needs to be freely given, specific, informed and active. This means that consent cannot be used as a legal ground in situations

where "there is a clear imbalance between the data subject and the controller in particular where the controller is a public authority". 9 The use of the consent in labour situations will most of the time be inappropriate for the same reasons. Furthermore, explicit consent is required in situations where serious data protection risks emerge, hence, where a high level of individual control over personal data is deemed appropriate. The WP29 guidelines state that the term 'explicit' refers to the way in which consent is expressed by the data subject. Explicit consent then means that the data subject must give an express statement of consent. It could be written, a two-stage verification procedure obtained through electronic forms, emails, electronic signature, etc. According to the principle of responsibility, 10 it is up to the controller to demonstrate the existence of an explicit consent. Therefore, the controller should have a register of all the consents given. Finally, the controller must ensure that the consent can be withdrawn by the data subject as easily as consent is given and at any time (Art. 7 (3) GDPR) 11 .

Reasons of public interest defined by Art. 9 (2) GDPR as a useful legal ground for the processing of Covid-19 vaccination-related data.

Art. 9 (2) GDPR provides several legal grounds where a public interest is at stake, in particular when the processing is necessary for: 8 WP29, Guidelines 05/20202 on consent under Regulation 2016/679, Version 1.1, adopted in May 2020, <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf> accessed 5 March 2021. 9 See Recital 43 GDPR. 10 See Art. 24 GDPR and the derivates principles of data protection by design and by default provided by Art. 25 GDPR.

11 See WP29, Opinion 2/2017 on data processing at work, adopted on 8 June 2017, p. 6.

reasons of public interest in the area of public health, such as the protection against serious cross-border treats to health (Art. 9 (2) (i) GDPR). Recital 54 clarifies that public health "should be interpreted as defined in Regulation (EC) 1338/2008 of the European Parliament and of the Council, namely all elements related to health; namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties such as employers or insurance and banking companies".

the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to a contract with a health professional (Art. 9 (2) (h) GDPR).

scientific research in accordance with Art. 89 (1) and Art. 9 (2) (j) GDPR.

The European Data Protection Board (EDPB) has recommended the uses of these legal grounds in the context of the Covid-19 outbreak. 12 The need to provide specific safeguard measures in case of processing for reasons of public interest.

Art. 9 (2) (h) and (i) GDPR explicitly refer to the respect for professional secrecy and, more globally, the rights and freedoms of the data subject. Here, the case law of the European Court of Human Rights (ECtHR) on Art. 8 of the European Convention on Human Rights (ECHR) is particularly relevant. 13 The ECtHR recalls in its case law that "the protection of personal data, in particular medical data, is of fundamental importance to a person's enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general". 14 Furthermore, these safeguard measures should be provided by either national or EU law.

The need to conform to other provisions of the GDPR. Beyond some specific provisions, the processing of data concerning health have to comply with the general provisions of the GDPR. In particular, the data protection principles mentioned in Art. 5 GDPR. 15 These national restrictions shall:

be based on EU or domestic Law, -respect the essence of the fundamental rights and freedoms, -be necessary and proportionate measures in a democratic society.

The national restrictions need also to conform to Art. 8 (2) ECHR, and Art. 51 and 52 of the Charter of Fundamentals rights of the EU (CFREU). This is explicitly mentioned in the recital 73 GDPR. The main issues of the vaccination campaign. The law shall detail the purposes of the processing, the categories of data concerned, the controller and possibly the processor, the recipients, the rights of the data subjects and their potential limitations, the retention period and who can have access to the data, clarifying in each cases the conditions to access. Finally, the obligations between the processor and the controller in the context of the Covid-19 vaccination need to be secured in a contract according to Art. 28 (3) GDPR.

The main issue is to clarify who is allowed to process the vaccination data, for what purposes, and what are the rights of the data subject in particular:

the right to be informed as defined by Art. 11 to 14 GDPR the right to object as defined by Art. 21 GDPR As the Covid-19 vaccination campaigns imply the processing of sensitive personal data at a large scale with high data risks, a data protection impact assessment (DPIA) is required according to Art. 35 GDPR.

The following is a non-exhaustive list of questions to consider in relation to the Covid-19 vaccination.

How is the prioritisation of the vulnerable persons made? Who can receive the benefit of the vaccine?

Here, two kinds of difficulties related to data protection could appear:

-Data collected for further purposes should be based on a legal ground. It could be a compatible purpose according to Art. 6 (4) GDPR. It could also be explicit consent or a Member State's law. Here, the main difficulty is to demonstrate that the consent is freely given, informed and unambiguous, as required by Art. 7 GDPR.

-The selection of the person who can benefit from the vaccine could be seen as "profiling". According to Art. 4 (4) GDPR "profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movement". In the case of profiling, specific safeguards are required, such as a prior DPIA (Art. 35 GDPR). Furthermore, Art. 22 GDPR provides a right "not to be subjected to a decision based solely on automated processing including profiling which produces legal effects concerning the data subject or similarly significantly affects him or her".

Here again, an algorithmic profiling decision of the beneficiary of the vaccine could only be authorised by Member State or Union law, which also lays down suitable measures to safeguard the data subjects' rights and freedoms and legitimate interests or on the data subject's explicit consent.

How will the collection of personal data, including sensitive data, be done in order to carry out the vaccination? What kind of information should be provided by the data subject in order to prove that he/she can benefit from the vaccine? Who will have access to these personal data and for which purposes? What kind of prior information should be given to the data subject on the future processing of his/her personal data?

What are the modalities of the vaccine registration database which compiles data on people who get vaccinated? How does one guarantee that this database will not be used for surveillance purposes? In particular, could the database be the steppingstone to the creation of a so-called "immunity passport" that would prevent unvaccinated people from accessing certain amenities, such as airports, cinemas and restaurants?

What are the security safeguard measures for the processing of sensitive data? According to the principle of minimisation (Art. 5 (1) (c) GDPR), the processing of sensitive data has to be limited to what is strictly necessary with regards to the purposes for which they are processed. The security principle implies the need to take appropriate technical and organisational measures to ensure the integrity and the confidentiality of the personal data. As mentioned in Art. 35 GDPR, those measures could be pseudonymisation and encryption of personal data, testing campaign, etc.

Is the processing of sensitive health data limited to the EU Member States? How can one be sure that there is no transfer to a third country, which does not have an equivalent protection as the one guaranteed by the GDPR? This raises the question of the use of processors outside the EU.

Proof of vaccination as a prerequisite to access some services. This is a very sensitive issue which goes beyond the immunity passport or digital certificate of vaccination. Could the operators of restaurants, bars and cultural events, as well as public transports, collect the contact details of their clients? Could these same actors ask for proof of vaccination? Could an employer enquire whether his/her employees are vaccinated? Could he/she require that his/her employees are vaccinated? Could a university limit access to visitors, including students, who are vaccinated?

Upon which legal grounds could highly intrusive measures be adopted by private actors and/or public authorities? Consent would not be very helpful in most of these situations because it will not be freely

given. It should be based on either EU or Member State law and ensure that fundamental rights are respected. The fact that the vaccine is not available for everyone (as yet) who may want to be vaccinated should be taken into account. This could lead to serious discriminations or at least ethical problems. It will be up to the Member States to implement this interoperable "Green certificate" in their healthcare system and to decide the modalities of it uses as a prerequisite to access some services. 20  There are two main differences between the studied States regarding their approach to the processing of Covid-19 vaccination-related data:

o Some States, such as France and Germany, adopted a detailed and precise framework for the processing of data related to the Covid-19 vaccination, which is not the case of Belgium and Switzerland.

o The role of the data protection authorities in ensuring compliance with data protection standards even in times of pandemic varies. The Belgian authority seems to struggle to be consulted, and when it is consulted, to be heard. Only the CNIL adopted a public report on the implementation of the processing related to fight against the Covid-1926 .

The other national authorities seem to have less activities of control, and more activities of information and regulation.

 There is a need to ensure the transparency of the processing of data regarding the Covid-19 vaccination as much as possible. Good practices have been found such as:

o an obligation from the government to report to its parliament on the implementation of the processing related to fight against the Covid-19 as it exists in France (see Art. 11 of the Loi No 2020-546).

o the possibility for the data subject to have access to entities which processed his/her Covid-19 vaccination data (proposed in vain by the Belgian data protection authority). For what purposes?

Organisation, traceability and monitoring of vaccination.

The identification of persons eligible for vaccination with regard to vaccination recommendations.

-Sending or issuing vaccination invitations.

-Recording of information relating to the consultation prior to vaccination and vaccinations.

-Management of any reminders on vaccination and summaries of information relating to vaccination for vaccinated people.

-Monitoring the supply of vaccines and consumables, in order to organise their availability in vaccination places.

-Steering of the system and monitoring of actions.

-Individualised information for people vaccinated in the event of a new risk.

-Financial support for the prior consultation and vaccination procedures. -The National Public Health Agency "Santé publique France", to monitor vaccine coverage and measure vaccine effectiveness.

-Regional health agencies (ARS) to ensure the organization of the vaccination campaign at the regional level and its monitoring.

- The Law No 78-17 of 6 January 1978 relating to information technology (IT), data files and civil liberties, better known as LIL, is a French law that regulates the freedom to process personal data. A new LIL has been adopted in order to adapt French Law both to the GDPR and to the so-called Police Directive. 28 In this new version, France made moderate use of its "margin of manoeuvre". 29 The new LIL provides a new section 3 of Chap. 3 on health processing which includes general provision for processing with public interest purposes and specific provision on the processing for research purposes, studies and evaluation in the health sector. The health processing in the scope of this new chapter needs in principle a prior authorisation,30 except if they are based on "règlements types, réferentiels31 or methodologies de références"32 for which only a declaration of conformity transmitted to the CNIL is needed. Nevertheless, Art. 65 LIL provides that an important part of the processing of data concerning health are not the scope of these French provisions, but on the one of the GDPR. This is the case of the processing of data concerning health:

based on one of the grounds enshrined in Art. 9 GPDR, such as explicit consent, processing necessary for the purposes of preventive or occupational medicine, the protection of the vital interests of the data subject, data made public by the data subject.

made by some entities, such as services with a public service mission and with the unique purpose to respond and manage the consequences following a health warning in case of emergency, the service of health insurance, doctors in charge of the medical information in hospitals and the Regional Health Agencies (ARS).

-

In a nutshell, the new section 3 of the LIL is much more focused on the data resulting from the care of people and the research in the health sector.33 1 Furthermore, the law on the modernisation of the French health system 34 and the law related to the organisation and the transformation of the heath system 35 in conjunction with the plan "My Health 2022", 36 promote a new framework for the access to health data. The rationale is to implement a balance between individuals' rights and the need to promote medical data by improving their care and easing their access through the SNDS (National Health Data System). 37 In this context, the French Health Data Hub was created in order to share health data from various sources for the purpose of research. 38 This legal context leads to the creation of "legal authorisations allowing the transmission of data resulting from information covered by secrecy by a professional". 39 In counterpart, several guarantees apply. The data in the SNDS are pseudonymised. In particular, The invalidation of the Privacy Shield 50 led to the political decision to renounce this processor within two years [START_REF] Lausson | Microsoft n'hébergera plus les données de santé des Français d'ici « deux ans », promet Véran[END_REF] and to use a European, if not French, cloud provider in the future. Second, a voluntarybased contact tracing application 'StopCovid' [START_REF][END_REF] was implemented, which has been recently transformed in Tousanticovid. [START_REF]TousAntiCovid" : la CNIL revient sur l'évolution de l'application "stopcovid[END_REF] Third, two health databases were created. 54 The first one, SI-DEP, is a secured platform placed under the responsibility of the General Directorate of Health (DGS) of the Ministry of Solidarity and Health. Its purpose is to centralise the data of patients who have been tested

for Covid-19. The second one, Contact Covid, is a digital tool used by all health professionals. Contact Covid aims to detect contact cases at three different levels: town doctors / health establishments / health centres (level 1); authorised health insurance staff (level 2); regional health agency (ARS) (level 3). In November, the existence of these health databases has been prolongated until the 21 April 2021, with some improvements. [START_REF]12 mai 2020 relatif aux systèmes d'information mentionnés à l'article 11 de la loi n° 2020-546 du 11 mai[END_REF] According to the French law on health emergency, [START_REF]11 of the Loi prorogeant l'état d'urgence sanitaire et complétant ses dispositions[END_REF] the CNIL reports to the Parliament on the implementation of these digital tools and audits them on a regular basis. Recently, the CNIL reported that some practices related to the Contact Covid database were not in conformity with the GDPR. working in a nursing home or assisted living). Two kinds of consent are needed. The first one is consent to the vaccination itself, as the vaccination is not compulsory. In principle, this consent should be registered by a health professional according to the rules of the CPH and the code of ethics. This means that prior information regarding the vaccine should be delivered. The Health Minister does not recommend a written consent. 60 The Health Minister delivered a questionnaire that the health professionals had to fill out and a check list for the nursing homes. 61 The appointments can be booked by city doctors through a pre-vaccination consultation, by phone, or by internet. People have the choice to use an online directory set up by the government or three private pre-existing companies of medical booking: Doctolib, Maiia or KelDoc. These private companies are processors, as they process the personal data on behalf of the Health Minister. To select these three companies, the Ministry of Health did not launch a call for tenders, as this kind of procedure is too long. 62 However, these private companies have been selected on the basis of pre-constitute "… offers of a public purchasing centre", of which Doctolib, Keldoc, and Maiia were already "holders". One could imagine that the specific obligations of these controllers for the processing of data related to the Covid-19 vaccination were introduced in their public procurement contract. However, this information has not been made public. In addition, it is not clear whether the data subject will have specific rights for the processing of their appointments to the vaccination centre. This information is given when the data subject makes their appointment, but nothing is said on the website.

The use of private companies has only been criticised by a far-right leader on political grounds. 63 This also raised confusion in the public about whether these private companies process health data. According to the above-mentioned definition of Art. 4 GDPR, it is clear that these companies process data concerning health, but medical data does not seem to be involved for the moment. Nevertheless, this could change in the future. In a press release in which Doctolib dealt with the criticism regarding its role in the vaccination campaign, the company announced that it was working with doctors to prepare the deployment of the vaccination management solution for the decentralised vaccination phase. 64 It is unclear whether this could be implemented without the certification of Doctolib as a "Health Data Host". According to the CHP: "Any natural or legal person who hosts personal health data collected during prevention, diagnostic, care or medico-social monitoring activities on behalf of natural or legal persons at the origin of the production or collection of these data or on behalf of the patient himself, must be approved or certified for this purpose". 65 Currently, Doctolib is not on the list of the "hébergeurs de données de santé", made public by the Health Minister. 66 According to its website, Doctolib uses Amazon Web Services as a Health Data Host (HDS certified). 67 One might wonder whether this implies that American intelligence authorities could access health data of European data subjects and therefore could be not conform since the invalidation of the Privacy Schield 68 . This raises again the question of the European digital sovereignty and, perhaps, the need to support or create European companies as Health Data Hosts. Recently, OVHcloud obtained the ANSSI security visa for its SecNumCloud qualification. 69 It reinforces the legitimacy of the French company, which has been a host of health data since 2019. Furthermore, whereas Doctolib has a consolidated data protection policy, 70 this is not the case of the others' website. 71 Nevertheless, on its website, the definition of health seems limited to medical and care data, which is not the approach of Art. 4 GDPR. Doctolib's website clarifies that it does not sell that kind of data and does not use it to advertise or sell services.

This affirmation is confusing because it applies apparently only to data concerning health and not to other personal data. For instance, Doctolib uses cookies for advertising purposes, which makes it possible to offer Internet users personalised advertising. 72 In the first stage of the vaccination campaign, technological difficulties appeared (delay in the launching of the government's website, default in the setting of the website authorizing people to take appointment prior the date of the launching of the campaign, or configuration problems preventing appointment etc.). 73 70 Doctolib adopted two charters on data protection with 10 commitments to protect personal health data beside a page on its data protection policy. See: Doctolib, 'Data Protection Information' (2021), <https://about.doctolib.fr/protection-des-donneesde-sante.html> accessed 5 March 2021. It claims to have commitments beyond its legal obligations based on control, uses, and security.

71 On KelDoc's website, references to data protection are not clearly accessible; you need to click on the legal notice put in the footer. KelDoc, 'Mentions Légales' (2020), <https://www.keldoc.com/a-propos/mentions-legales> accessed 5 March 2021. The page includes the term of uses, and a notice on consent describes the data protection policies and the policy on cookies, which is not in line with the recent guidelines and recommendations of the CNIL, Délibération portant adoption d'une recommandation proposant des modalités pratiques de mise en conformité en cas de recours aux « cookies et autres traceurs » [17 September 2020] No 2020-092; and Délibération portant adoption de lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture et écriture dans le terminal d'un utilisateur (notamment aux « cookies et autres traceurs ») [17 September 2020] No 2020-09. Maïa's website includes a confidentiality policy page where data protection policy is described. 72 Doctolib, 'Informations sur les cookies' (2020), <https://www.doctolib.fr/cookies> accessed 5 March 2021.

73 Keren Lentschner, 'Vaccinations des plus de 75 ans : le grand ratage des prises de rendez-vous' Le Figaro (Paris, 14 January 2021), <https://www.lefigaro.fr/economie/vaccination-des-plus-de-75-ans-les-bugs-de-la-prise-de-rendez-vous-20210114> accessed 5 March 2021.

The creation of the new data base SI Contact Vaccin. 74 The General Health Directorate and the CNAM are joint controllers of this new data base SI Contact Vaccin, which is based on reasons of public interest in the area of public health, such as protecting against serious cross-border treats to health, according to Art. 9 (2) (i) GDPR. This processing has five purposes related to the organisation, traceability and monitoring of vaccination.

The categories of data collected in SI Vaccin Covid. 8 categories of personal data, which will be collected by the health professionals, are contained in the SI-Vaccin. The categories of data to be processed are set by the decree and are limited to those strictly necessary for the management and monitoring of vaccination.

 For people eligible for vaccination and/or vaccinated, the following data are collected:

o The identification data of the person concerned, as well as his contact details.

o Data relating to the affiliate organisation.

o Data relating to the completion of the vaccination.

o The following health-related data: information relating to the medical eligibility criteria for vaccination and the treatments followed by the person concerned, information relating to the search for and identification of contraindications to vaccination, report of adverse effects associated with the vaccination, as well as, where applicable, details of these adverse effects.

o Information on non-medical eligibility criteria for vaccination.

 For health professionals participating in the care (vaccination consultation, vaccination certificate) and people under their responsibility, the following data are collected:

o Identification numbers and data.

o Contact details o Traceability data for all actions carried out in the teleservice.

Data recipients. The list of the data recipients is quite extensive. 75 The CNIL raises three categories of concerns, 76 which have yet to be addressed by the government. First, some processing activities seem to go beyond the missions of the Digital Directorate of the Health Ministry, which is in charge of the 74 See: Décret autorisant la création d'un traitement de données à caractère personnel relatif aux vaccinations contre la Covid-19 [25 December 2020] No 2020-1690. 75 See the synthetic board provided above. digital transformation, 77 and receives the power to provide information and guidance to people vaccinated in the event of a new risk associated with the vaccine.

Second, the decree eludes the sensitive question of the role of the processor. This information has not even been made public on the Minister's website, which is a total lack of transparency. This is one of the reasons why the CNIL insisted on an explicit reference that no transfers were made outside the EU. Maybe the government found it was sufficient that this guarantee had been introduced in the modalities of implementation of the health emergency 78 . However, it would have been more relevant not to link this guarantee to the state of health emergency, as explicitly suggested by the CNIL.

Third, there are still a lack of coherence between the purposes provided in Art. 1 of the decree and the information given regarding the recipient. In particular, Art. 3 (4) declares that data sent to the Health Data Hub is processed for management of a health emergency and not only for the knowledge of the virus. However, this purpose is only foreseen in the decree on health emergency.

The following persons or organisations may be recipients of the data recorded with regards to the Covid-19 vaccine:

-The doctor treating the vaccinated person;

-The digital department of the ministries responsible for social affairs, as a trusted third party to provide information and guidance to people vaccinated in the event of a new risk associated with the vaccine;

-The National Agency for the Safety of Medicines and Health Products and the regional pharmacovigilance centres when a health professional makes a declaration of an adverse event;

-The public health information service, for information only on health professionals and possible vaccinations in order to fulfil its mission of free dissemination of the health care offer available to the general public.

After removal of any data allowing the direct identification of an eligible and/or vaccinated data subject, the data required for the performance of their duties are addressed:

-The National Public Health Agency "Santé publique France", process the data necessary to monitor vaccine coverage and measure vaccine effectiveness.

-Regional health agencies (ARS) process the data necessary to ensure the organisation of the vaccination campaign at the regional level and its monitoring. -The Research, Studies, Evaluation and Statistics Department of the Ministry of Health, for uses the data necessary for its mission of analysing and disseminating statistical information in the health field.

-

The "Health Data Hub" and the "CNAM" process data to facilitate the use of health data for the needs of managing health emergencies and improving knowledge on virus, unless opposed by the person concerned.

The rights of the data subject People remain free to enter the established vaccination circuit and be vaccinated against Covid-19. As such, people whose eligibility has been determined upstream by the compulsory health insurance bodies have the possibility of opposing the processing of their data, as long as they do not go down the vaccination road, that is to say, as long as they have not benefited from a consultation prior to vaccination. People who are on the vaccination road may, at any time, oppose the transmission of their data for research purposes to the health data platform "Health Data Hub" and to the National Fund of health insurance. All data subjects have the right to access and rectify their data as well as the right to limit processing. Once the data subject has agreed to the vaccination, he/she has no right to erasure. This restriction is based on reasons of public interest in the area of public health according to Art. 17 (3) (c) GDPR.

These rights are exercised upon written request addressed either to the Director of the parent organisation (CPAM), to the Data Protection Officer or on the space provided for this purpose in the person's "ameli" account. In the event of difficulties in the application of the rights set out above, any person can also lodge a complaint with the CNIL. 79 The retention periods. The data is kept for 10 years to ensure that all the obligations related to the traceability of the vaccination are complied with. The data necessary to inform and refer to vaccinated persons in the event of the appearance of a new risk linked to the vaccine are kept for 30 years in a dedicated database.

B.3.1.3 Proof of Vaccination as a Prerequisite to Access Some Services

No go for a Covid-19 vaccination certificate. On several occasions members of the government expressed serious concerns regarding the proposal of a Covid-19 vaccination certificate, whereas a recent survey declares that 62% of French people are in favour of a vaccination certificate for travelling and one out of two respondents asked for it to be compulsory to take public transport. [START_REF] Bayard | Certifcat de vaccination : une majorité de Français séduite, les autorités réservées[END_REF] Last December, the Conseil d'État expressed serious concerns about the implementation of such a certificate, which could derogate to the medical secrecy. [START_REF]Avis du Conseil d'État[END_REF] A complex multi-level system of data protection laws. As France, Germany is a pioneer in data protection. 83 Germany adapted the Federal Data Protection Act ("Bundesdatenschutzgesetz" also called BDSG) to the provisions of the GDPR in June 2017 and other sectoral laws were adapted in November 2019. [START_REF]/680 (Zweites Datenschutz-Anpassungs-und Umsetzungsgesetz EU-2. DSAnpUG-EU[END_REF] The federal German states completed the adaption of their state laws to the provisions of the GDPR in 2018. Besides the Federal data protection laws, there are data protection laws in each Region ("Land,") which basically provide the legal framework within which the public authorities of the Region may process personal data. [START_REF]All the data protection laws enacted by the regions (Länder) are available at: <https[END_REF] Each Land disposes of its own Data protection authority which may also be competent for other topic, such as the right to information. In addition, the German Federal Commissioner for Data Protection and Freedom of Information ("Bundesbeauftragte für Datenschutz und Informationsfreiheit" (BfDI)) is the Data Protection Authority for telecommunication service providers and represents Germany in the European Data Protection Board. To ensure that all the authorities have the same approach, a committee consisting of members deviate from the GDPR. For the purpose of the present overview, only some examples will be given.

The SGB provides several provisions which limit the rights of data subjects enshrined in Art. 23 GDPR.

According to § 82, sec. 1 SGB-X, the controller is authorised not to inform the data subject about the recipients of personal data or about the processing of personal data for further purposes than the original one. It is only required that the controller take adequate measures to protect the interest of the data subject. This seems far too vague to be in line with Art. 23 (2) GDPR, which requires Member

States to list a number of measures in order to show respect of the fundamental rights and freedoms of the data subject.

The recent adoption of two major laws that affect data protection. The digital health care law of December 2019 91 and the so-called patient data protection act (PDSG) of July 2020 92 raised several concerns on data protection. [START_REF] See | Bundesdatenshützer: Offene Warnung zur elektronishen Patientenakte[END_REF] Both laws aim at driving forward the digitisation of the healthcare system. The digital health care law allows for the use of online applications in order to get prescription, an easy use of online video consultations and access to a secure healthcare data network for treatments everywhere. [START_REF] Spiecker Genannt Döhmann | Schutzlos in Karlsruhe -Neue Maßstäbe im einstweiligen Rechtsschutz und im Datenschutz vor dem Bundesverfassungsgericht[END_REF] The patient data protection act aims at bringing digital solutions to patients while respecting their personal data protection, and includes the right of patients to receive an electronic patient record ("ePA") and have their doctor fill it in. Important medical documents, such as vaccination cards, are saved in the file. In order to access services of their health care providers, patients may grant them the right to access their medical data. This provision has been heavily criticised as it represents an open invitation of the health care providers to request disclosure from their patients. [START_REF] Py | Impact of EU Regulation 2016/679 on the French health system[END_REF] That a new § 335, sec. 3 SGB-V forbids (positive or negative) discrimination because of access granted to data is considered to be insufficient. 96 Also, it has been considered that the position of the publicly owned corporation Gematik GmbH, which designs the telematics infrastructure as a intermediator, does not respect the GDPR. 97 Gematik should be rather defined as a joint controller.

B.3.2.2. The Processing of Data During the Covid-19 Vaccination Campaign 98

General overview. In Germany, the Ministry of Health ("Bundesministerium für Gesundheit") has used § 5, sec. 2, no. 4, lit. c and d IfSG ("Infektionsschutzgesetz") as a legal basis to issue the Verordnung zum Anspruch auf Schutzimpfunggegen das Coronavirus SARS-CoV-2 (Coronavirus-Impfverordnung -CoronaImpfV). However, it has been argued that the prioritization of certain categories of people requires a proper act of the Parliament. 99 Whereas it is unlikely that such a law will be enacted, this could change if someone successfully brought a claim before the BVerG. Some DPAs have issued statements regarding the vaccinations and data protection. The DPA of Rheinland-Pfalz for example has stated: "As a state authority, we were involved in the development of the vaccination structures at an early stage. Our suggestions, especially regarding the transparency of data processing, were all taken up. As things stand, I am therefore convinced that data protection will be fully respected in the upcoming vaccinations. However, as the data protection supervisory authority, we will closely monitor in the coming months whether this is also the case". 100 The domestic DPAs were involved in drafting the patient information required by Art. 13 GDPR.

Appointments to get vaccinated at a Covid-19 vaccination centre. The Länder are in charge of the implementation of the Covid-19 vaccination campaign for their inhabitants. 101 Apparently, the difficulties to get an appointment led to some "vaccination tourism" between the Länder.102 § 8

CoronaImpfV clarifies that "The National Association of Statutory Health Insurance Physicians shall develop and operate a standardised module for the telephone and digital arrangement of appointments in the vaccination centres, which shall be made available to the Länder for the organisation of appointment allocation". Furthermore, § 6 ( 4) CoranaImpfV provides a list of the data that can be collected in order to prove that the patient is a beneficiary of the prioritisation decided in the national immunisation strategy.

Focus on the implementation in two Länder: Rhineland-Palatinate and Berlin. The data protection authority of Rhineland-Palatinate elaborated a FAQ103 which gives guidelines on several topics including: 98 For more details on the vaccination campaign in Germany, see: Alessandra Donati and others (n 57) 54. 99 The Liberal Party (FDP) has even presented a draft for such an act (Bundestag Drucksache 19/25260).

 the legal basis upon which information about the person to be vaccinated will be collected and stored before the vaccination. It refers basically to the rules of the GDPR and clarifies that the legal grounds are Art. 6 (1) (b) and 9 (2) (h) GDPR.

 the conditions under which third parties are allowed to allocate appointments to citizens interested by corona vaccination. It refers basically to the rules of the GDPR related to the need of consent, which should not necessarily take a written form. The data processed by the authorised representatives for appointment registration may only be stored by them for as long as this is necessary. This data must therefore be deleted at the latest after the agreed vaccination appointment has been carried out.

 It declares that the Ministry of Social Affairs, Labour, Health and Demography is responsible for compliance with data protection regulations in connection with corona vaccinations by vaccination centres and mobile vaccination teams (Art. 24 GDPR). This means that the Ministry of Social Affairs, Labour, Health and Demography must take suitable technical and organisational measures, inter alia taking into account the need to protect the health data processed in the context of the vaccinations, in order to guarantee legally compliant and secure data processing. Moreover, the rights of those affected, such as the right to transparent information about data processing or the right to information, must be ensured by the Ministry of Social Affairs, Labour, Health and Demography.

In the Land of Berlin, the appointments can be made online through Doctolib. 104 The website of the Land contains an extensive notice on data protection rules for the Covid-19 vaccination. 105 This information clarifies that the controller is the "Senatsverwaltung für Gesundheit, Pflege und Belgium has adapted its national legislation to the GDPR in several steps110 . First, the Law of 3 December 2017 transformed the Belgian "commission de la vie privée"111 into a real Data Protection Authority: the "autorité de protection des données". Second, the Law on the protection of individuals with regard to the processing of personal data of 30 July 2018 (the "Framework Act")112 deeply reformed substantial Belgium data protection law in light of the GDPR and the Police Directive. Art. 9

of the Framework Act provides additional clarifications on the processing of sensitive data, including data concerning health:

In compliance with Article 9.4 of the Regulation, the controller shall take the following additional measures when processing genetic, biometric or health-related data:

1° the categories of persons having access to personal data are designated by the controller or, where appropriate, by the processor, with a precise description of their function in relation to the processing of the data in question;

2° the list of the categories of persons thus designated is kept at the disposal of the competent supervisory authority by the controller or, where appropriate, by the processor;

3° it shall ensure that the persons designated are bound by a legal or statutory obligation, or by an equivalent contractual provision, to respect the confidential nature of the data concerned.

Third, in September 2018, a "Comité de sécurité de l'information pour contrôler les données de sécurité sociale et de santé" has been created. 113 This Committee has two main tasks. First, it authorises certain communications of social and health data by adopting prior deliberations. Second, it promotes the compliance with legislation on the protection of these personal data. In other words, the Committee is not a supervisory authority in the sense of Art. 54 GDPR. However, it is in charge of prior formalities114 . This occurs it particular in situation of communication/transfer/sharing of health or social data115 .

In addition, Art. 20 of the Framework Act requires a protocol for certain data transfers from a public Federal authority 116 . Such a protocol is needed when the processing is based on one of the three following purposes: compliance with a legal obligation (Art. 6 (1) (c) GDPR), the need to protect the vital interests of an individual (Art. 6 (1) (d) GDPR), and the performance of a task carried out in the public interest or in the exercise of official authority vested by the controller (Art. 6 (1) (e) GDPR). The rationale of the protocol is to give more reality of the responsibility principle of the controller. It also enables a transparency with regard to the citizens because the protocols are made public.

Finally, the existence of three main e-government tools in Belgium are worth mentioning, as they play a role in the processing of data concerning health: (1) the "Banque carrefour de la sécurité sociale", 117

whose main mission is sharing and collecting social data;

(2) the Digital e-Health plaform, 118 a federal public institution whose mission is to promote and support well-organised, mutual electronic service provision and information exchange between all healthcare stakeholders, with the necessary guarantees in terms of information security, protection of the privacy of the patient and the healthcare provider, and respect for medical confidentiality; (3) "Ma santé", also called "Personal Health viewer", 119 is an online portal conceived as a central access point which allows people to consult various personal data concerning their health and other health-related information in general. Council of Ministers, the methods of this recording and defines at least the purposes of data processing, the categories of persons about whom data are processed, the categories of data processed, the persons responsible for processing the data and the duration of data storage". This law is very vague and delegates too much power to the King. 122 Furthermore, the law was adopted without the opinion of the Conseil d'État or the Belgian Data Protection Authority. 123 In practice, four data bases are used for the vaccination campaign 124 (see the figure below):

 The database of vaccination codes, which is managed jointly by the federated entities responsible for the organisation of the vaccination and Sciensano. 125  Vaccinet, a system for ordering and distributing vaccines made available to vaccinators by the Flemish government as part of its programmatic vaccination policy. It is used at the national level for registering the administration of Covid-19 vaccines and reporting possible side effects.

 VONS (Vigilance Online Notification System) of the Federal Agency for Medicines and Health Products, which collects data on adverse reactions to the vaccines Covid-19. The data are pseudonymised.

 Covid-19 LaboratoryTestResult collects the Covid-19 tests and is also managed by Sciensano.

The rationale here is to be able to make a connection between contact cases and the vaccinated people.

Source: https://www.ehealth.fgov.be/fr/esante/information-vaccination 123 This is not in line with Art. 36 (4) GDPR as underlined by the authority itself when it has been seized by the project of Royal Decree. See Avis 138/2020 of 18 December 2020 n°7. 124 See: <https://www.ehealth.fgov.be/fr/esante/information-vaccination/description-des-bases-de-donnees>.

125 It is a public institution with legal personality established by the Law of 25 February 2018 establishing Sciensano. It protects public and animal health. Since September 2020, Siensano manages the database that supports specific functions of the contact tracing application (the so-called Coronalert App). See: <https://www.sciensano.be/en/health-topics/coronavirus/role#managedatabase-to-support-contact-tracing>.

Art. 3 of the Royal decree on 24 December 2020126 clarifies what the six categories of collected data should be for each vaccination. This includes the data allowing the identification of the vaccinated persons, the vaccine and the health professional who administered it, the localisation of the vaccination centre, and the report on possible side effects. One could whether localising the vaccination centre is absolutely necessary. 127 Art. 4 of the Royal decree authorises the processing for ten purposes.

Three provisions of the Royal decree raise important concerns. First, Art. 5 describes, in very vague terms, who can have access to the database. Art. 5 provides that after authorisation of the abovementioned "Comité de sécurité et d'information" the data can be transferred to "bodies with a mission of general interest for the purposes for which these bodies are responsible by or by virtue of a law, decree or ordinance". As the Data Protection Authority underlined, a list of the categories of recipients should have been included. There is a risk that entities use the access to this database for denying access to public services, even if the vaccine is not compulsory. 128 As an additional guarantee, the Data Protection Authority recommended to give data subjects the right to get a list of the entity which have access to their data of vaccination.129 However, the advice of the Data Protection Authority was not followed by the government, which maintained the broad possibility of transfer to entities pursuing a mission of public interest. The main argument is that this transfer needs to be authorised by the comité de sécurité et d'information. Second, Art. 6 of the Royal decree provides a very long data retention period; the data can be stored until two years after the death of the person. Third, Art. 7 clarifies the status of joint controller of the seven entities involved in the running of the database but leaves it up to a protocol between the competent entities for more details. In the same way, the role of the eHealth platform is not very clear. In Switzerland, the Federal Act on Data Protection of 19 June 1992 (FADP)131 provides a special protective regime for the processing of sensitive personal data (Art. 3(c) FADP). 132 In particular, information related to heath falls within the scope of sensitive personal data. In order for such data to be lawfully processed, the express consent of data subjects is necessary (Art. 4(5) FADP). Processing may be carried out by private persons (such as self-employed doctors) or federal bodies (such as health insurers). 133 In all cases, any processing must comply with the general principles of Art. 4 FADP:

1. Lawfulness (the data is not obtained under duress or by fraud, for example);

2. Good faith (the data subject is informed of the processing and the latter does not take place against his/her will);

3. Proportionality (only data essential to the processing are collected);

4. Transparency (the collection of personal data and the purpose of processing must be evident to the data subject) and;

5. Purpose limitation (the purpose that is specified or agreed upon at the time of collection can be clearly deduced from the circumstances at the time of collection or is provided for by law).

Private persons must process personal data lawfully. In particular, according to Art. 12 FADP, processing is unlawful if it contravenes the general principles of Art. 4 FADP, it is carried out against a person's express wish without justification, it has as its object the disclosure of sensitive personal data or personality profiles to third parties without justification. Unlawfulness may be waived in three cases, as Art. 13 FADP states: the breach of privacy is lawful if it is justified by the consent of the injured party, an overriding private/public interest or the law. Art. 14 FADP establishes a duty to actively provide information in case sensitive personal data are collected. In particular, the controller must at least disclose his/her/its identity, the purpose of the processing, and the categories of data recipients, if a disclosure of data is planned. In light of this, if an employer orders that the body temperature of employees is measured before they enter the premises of their workplace, their express consent is needed because sensitive personal data is processed. Such a measure must respect the principle of proportionality.

As for federal bodies, they are allowed to process sensitive personal data only if a legal basis in the formal sense, i.e. a law, permits it (Art. 17 FADP). Art. 17(2) FADP states that, exceptionally, the processing of sensitive personal data without a legal basis in the formal sense is possible when:

1. the accomplishment of a task clearly defined in a law in the formal sense so requires;

2. the Federal Council has given such authorisation, considering that the rights of the persons concerned are not threatened, or;

3. when the data subject has, in this case, consented to it or has made his/her data accessible to everyone.

Federal bodies also have a duty to inform data subjects about the collection of personal data (Art. 18a FADP). In principle, the communication of personal data is also submitted to the existence of a legal basis, but some exceptions exist (Art. 19 FADP) Since the vaccination is organised at the cantonal/local level, the way people can get an appointment and the type of data that they must share with the vaccination centres have to be found on the corresponding regional websites. Note that cantonal, public authorities are submitted to regional provisions on data protection. 136 In the canton of Vaud, for example, a specific webpage has been opened by the Centre universitaire de médecine générale et santé publique, 137 so that people can fulfil an evaluation form online or by phone in order to determine whether they can be vaccinated. If yes, they may book an appointment in one of the vaccination centres. Hence, people disclose sensitive personal data to the Centre. However, its website does not contain any data protection policy regarding the processing of sensitive personal data. It is unknow whether the data is stored or transferred to the vaccination centres or other bodies. 138

134 AstraZeneca is currently going through the approval procedure.

135 Such as high blood pressure, cardiovascular disease, diabetes, chronic respiratory diseases, cancer, conditions and therapies that weaken the immune system, and obesity class III (morbid, BMI greater than or equal to 40 kg/m 2 ).

136 For example, in the canton of Vaud, authorities are submitted to the LPrD (loi sur la protection des données, available at: <https://prestations.vd.ch/pub/blv-publication/actes/consolide/172.65?key=1543934892528&id=cf9df545-13f7-4106-a95b-9b3ab8fa8b01>). This law essentially maintains the requirements established by the FADP, in particular the processing of personal data requires a legal basis and, when sensitive personal data are involved, the express consent of data subjects is necessary.

137 Canton de Vaud, 'Unisanté; Coronavax' (2020), <https://coronavax.unisante.ch> accessed 5 March 2021. 138 In Bern, the VacMe online application, which is the equivalent of coronavax in the canton of Vaud, offers more details regarding access to and use of sensitive personal data by healthcare professionals (the declaration of consent is available at In particular, since health insurance companies finance part of the costs associated with the vaccination, they might want to obtain the name of clients/patients who are vaccinated. A fertile ground for discrimination could be created as result, as people might receive a different treatment/be offered different services, depending on whether they are vaccinated or not. Additionally, a transfer of sensitive personal data to Swissmedic (the authority which authorises vaccines on the Swiss market) could occur in case adverse side effects are observed on vaccinated persons. Indeed, according to the Therapeutic Products Act (Art. 59) and the Therapeutic Products Ordinance (Art. 63), healthcare professionals are required to report the occurrence of a serious, or previously unknown, adverse drug reaction. In all cases, it has to be recalled that the disclosure of sensitive personal information by private persons is not allowed without a justification, such as the data subject's express consent. As for federal/cantonal authorities, we highlighted earlier that the processing of personal data depends, in principle, on the existence of a legal basis (Art. 17 FADP). The disclosure of sensitive personal data to Swissmedic seems to comply with that requirement as the obligation to report adverse side effects is required by the Therapeutic Products Act. However, it is unclear whether vaccination centres comply with their duty to actively inform data subjects about the processing of sensitive personal data (Art. 14 and 18a FADP). It might be that they provide information on data protection on the day of the vaccination, but nothing is mentioned on their website.

The FOPH recently published a checklist that professionals of the medical field may use when they administer the vaccine. 139 According to this document, at least the following data is to be collected: the identity of the person to be vaccinated, the health insurance status, and clarifications regarding the health of the patient (pregnancy, allergies, etc.). Those data are recorded on a computer. Professionals carrying out the vaccination must "[o]btain the verbal consent to the vaccination of the person to be vaccinated and to the electronic recording of the vaccination in the data acquisition system". This is in line with Art. 4(5) FADP, although it is advisable to obtain a written consent.

Finally, a certificate stating the details regarding the vaccination is printed and given to the patient.

Alternatively, if the person to be vaccinated so wishes, the information regarding the vaccine against Covid-19 may be registered through "myCovidVac", a module of the Swiss electronic vaccination record for storing information about Covid-19 vaccinations run by the myvaccines foundation. 140 The "myCovidVac" website contains a policy on privacy,141 which states that the foundation "is very attentive to the federal rules concerning data protection" and that the "data will be treated with complete confidentiality and stored in Switzerland". Since that information will be transferred to the electronic vaccination record (myvaccines), the policy on privacy governing that record probably applies to information regarding the collected data, the purpose for which such data is collected or transferred to other professionals, as well as the duration of the storage could have been added. "myCovidVac" as well. The myvaccines website also contends that the Swiss law on data protection is respected,142 and that personal data is processed with the consent of data subjects. The website clearly identifies the people who access the data and acknowledges that transfer of data to third parties may occur. However, it has to be highlighted that consent cannot be given globally and, in case sensitive personal data is to be transferred to health insurers, for example, it seems that a more specific, express consent of data subjects would be required.

To conclude, the official documents published by the Swiss government show that persons to be vaccinated must give their express consent to the processing of their sensitive personal data, which is in line with the FADP. However, it is unclear whether people know exactly to what they consent, as important information is missing regarding the collected data, their potential transfer to third parties, their storage, etc. Therefore, it seems that the principle of transparency has not been sufficiently implemented.

B.3.4.3 Processing on Proof of Vaccination

As there is currently no obligation to be vaccinated against Covid-19, it is unclear whether the offer of some services could depend on a proof of vaccination. For example, could restaurant owners refuse access to their premises to persons who are not vaccinated? Could flying companies allow boarding upon proof of vaccination only? And could an employer impose vaccination to his/her/its employees?

As far as public authorities are concerned, proof of vaccination cannot be asked for without an appropriate legal basis, which they currently do not have. It has however been argued, based on contract law, that private companies are free to subject the conclusion of a contract to a proof of vaccination. In other words, access to a restaurant or an event could be restricted to vaccinated persons, based on the contractual freedom of private companies. According to Swiss labour law, the employer has the right to give instructions to his employees (Art. 321d Code of Obligations). In particular, he/she can oblige his/her employees to adhere to certain rules regarding safety and hygiene. At the same time, however, the employer must also respect the employee's personal rights (Art. 28 Civil Code), including physical integrity. An interference can be justified, among other things, by an overriding private or public interest.

However, it has to be highlighted that justifications based on contractual freedom are at odds with data protection law provisions, whereby sensitive personal data may only be processed with the consent of data subjects. In other words, the obligation to give sensitive personal data in order to have access to services clashes with the concept of consent. -EDPB Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the Covid-19 outbreak, adopted on 21 April 2020.

-EDPB Guidelines 10/2020 on restrictions under Art. 23 GDPR, adopted on 15 December 2020.

-EDPB Statement on the processing of personal data in the context of the COVID 19 outbreak, adopted on 19 March 2020.

-Opinion 2/2017 on data processing at work of the 23 June 2017, WP249.

-Statement on the processing of personal data in the context of reopening of borders following the Covid-19 outbreak, adopted on 16 June 2020.

- -CNIL and Conseil de l'Ordre National des Médecins, 'Guide pratique sur la protection des données personnelles' (2019), <https://www.conseilnational.medecin.fr/sites/default/files/externalpackage/edition/17ss6et/guide_cnom_cnil_rgpd.pdf> accessed 5 March 2021.

-CNIL, 'Les traitements nécessitant une déclaration de conformité' (2021), <https://www.cnil.fr/fr/traitements-declarationconformite?field_norme_numerotation_type_value%5B0%5D=6> accessed 5 March 2021.

-CNIL, 'Qu'est-ce-qu'une donnée de santé ?' (2021), <https://www.cnil.fr/fr/quest-ce-ce-quunedonnee-de-sante> accessed 5 March 2021.

-CNIL, '"TousAntiCovid" : la CNIL revient sur l'évolution de l'application "stopcovid"' (2020), <https://www.cnil.fr/fr/tousanticovid-la-cnil-revient-sur-levolution-de-lapplication-stopcovid> accessed 5 March 2021.

  e. the GDPR, is examined, and relevant references to the law of the Council of Europe and the main recommendations at the European level are made. The purpose of this first part is to assess what EU Member States should do and what margin of manoeuvre is left to those for the processing of data related to the Covid-19 vaccination. The second part of the research project consists in a comparative analysis of the data protection laws in the area of public health in France, Belgium, Germany and Switzerland, with specific references to the Covid-19 vaccination. The purpose of this second part is to understand and compare the approach taken in the selected States. This report is written by Dr Olivia Tambou, associate professor at the Université Paris-Dauphine, except for the report on Switzerland, which is written by Dr Alexia Pato, postdoctoral fellow at the University of McGill, Montreal. 2 See, e.g., Council of Europe, Digital Solutions to Fight Covid-19. 2020 Data Protection Report (October 2020), <https://rm.coe.int/prems-120820-gbr-2051-digital-solutions-to-fight-covid-19-text-a4-web-/16809fe49c> accessed 5 May 2021; our e-conference on Covid-19 and data protection issues on blogdroiteuropéen, available at: <https://blogdroiteuropéen.com/category/nos-contenus/e-conference/data-protection-issues-related-to-covid-19/> accessed 5 March 2021. A. European Framework for the Processing of Covid-19 Vaccination-Related Data A.1 Research Questions What are the main data protection issues in relation to the Covid-19 vaccination? Which lessons can be learned by analysing the European legal framework of the GDPR, the law of the Council of Europe and the statements of these organisations made in the context of the Covid-19 outbreak? A.2 Our Findings in a Nutshell  The processing of health data is defined broadly by the GDPR. Hence, different kinds of processing related to the Covid-19 vaccination are covered, such as:

Finally, Art. 89

 89 (2) GDPR provides another opening clause for derogations from the right to access, the right to rectification, the right to restriction and the right to object for processing of data for research purposes. The use of these derogations is submitted to safeguard measures, which should be introduced in the law of Member States. 19 has been recalled by a Joint Statement on the right to data protection in the context of the Covid-19 pandemic by Alessandra Pierucci, Chair of the Committee of Convention 108 and Jean-Philippe Walter, Data Protection Commissioner of the Council of Europe, adopted on 30 March 2020. For a comparative analysis of the Convention 108 and its modernisation (Convention 108+, which has already been named as a GDPR light), see: Olivia Tambou, Manuel de droit européen de la protection des données à caractère personnel (Bruylant 2020) 16. A.3.4. The Main Data Protection Concerns Related to the Covid-19 Vaccination

B-

  d'un traitement de données à caractère personnel relatif aux vaccinations contre la Covid-19 Art. L3111-1 of the CPH on vaccination Art. L3131-15 of the CPH on Health State emergency Loi n° 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés, especially its Articles 6 (sensitive data), 31 (prior formalities) and 35 (contents of the act who authorises a processing) et le traitement de données relatives aux vaccinations dans le cadre de la lutte contre la pandémie de COVID-19 declares that "The doctor or nurse who administers a vaccine against COVID-19 or who supervises the vaccination records each vaccination in the database designated by the Interministerial Conference on Public Health. The King specifies, by decree deliberated in the Council of Ministers, the modalities of this recording and defines at least the purposes of the data processing, the categories of persons about whom data is processed, the categories of data processed, the data controllers. data as well as the retention period of the data.The identification data of the person concerned, as well as his contact details.  Data relating to the affiliate organisation. Data relating to the completion of the vaccination.  The following health-related data: information relating to the medical eligibility criteria for vaccination and Data in order to prove eligibility and establish prioritisation are listed in §6-1-4 and should be processed by health professionals. §7 lists the data collected by 1° The surname, first name, sex, place and date of birth, place of principal residence and, -2° the identity data of the person who administered the vaccine, in particular the identification number -3° data relating to the vaccine, in particular the brand, batch number and identification number of the vaccine; -4° data relating to the time and place of administration of the vaccine; Traceability data for all actions carried out in the teleservice. -5° data relating to the vaccination schedule against Covid-19 of the person to whom the vaccine is administered; -6° data relating to the adverse effects of the vaccination of which the person who administered the vaccine or his



  For of vaccines against Covid-19 in order to ensure the monitoring of the "rapid alerts of vigilance" and "rapid alerts of quality" 4° the management of vaccination schemes against Covid-19 per person to be vaccinated or vaccinated; 5° the logistical organisation of vaccination against Covid-19, after anonymisation of the data or at least pseudonymisation of the data in the event that anonymisation would not make it possible to carry out the logistical organisation; 6° the determination of the rate of vaccination against Covid-19 of all users of care, after anonymisation of the data or at least pseudonymisation of the data in the event that anonymisation would not make of data to allow their reuse for the purposes of presenting the vaccination offer, monitoring vaccination coverage, measuring vaccine efficacy and safety, pharmacovigilance, producing indicators relating to the quality and consistency of statistics produced in the context of the health crisis, support for the evaluation of public immunization policy, and the conduct of studies and research. 7° the organisation of the follow-up of contacts in execution of the Cooperation Agreement of 25 August 2020 between the Federal State, the Flemish Community, the Walloon Region, the German-speaking Community and the Joint Community Commission, concerning the joint processing of data by Sciensano and the contact centres designated by the competent federated entities or by the competent agencies, by the hygiene inspection services and by mobile teams as part of a contact follow-up with (presumed) Covid-19 coronavirus-infected persons based on a database at Sciensano; data or at least pseudonymisation of the data in the event that anonymisation would not allow postauthorisation monitoring and surveillance to be carried out; 9°, the calculation of the distribution of immunisation costs between the federal State and the federated entities, after anonymisation of the data or at least pseudonymisation of the data if anonymisation would not make it possible to calculate the distribution; 10° the carrying out of scientific or statistical studies after anonymisation, or at least pseudonymisation if anonymisation would not make it possible to carry out the scientific or statistical study; Who can process these data? Who are the recipients of the data? Who can access to the data ? -The doctor treating the vaccinated person. -The digital department of the ministries responsible for social affairs, as a trusted third party to provide information and guidance to people vaccinated in the event of a new risk associated with the vaccine. -The National Agency for the Safety of Medicines and Health Products and the regional pharmacovigilance centres when a health professional makes a declaration of an adverse effect; -The public health information service, for information only on health professionals and possible vaccinations in order to fulfil its mission of free dissemination of the health care offer available to the general public. Not fully listed in the CoranaImpfV, but some clarifications are made by the Länder which are in charge of the vaccination.The competent federated entities or the agencies designated by the competent federated entities and the federal authority act, each for their competence.After removal of any data allowing the direct identification of an eligible and/or vaccinated data subject, the data required for the performance of their duties are addressed:

  The Research, Studies, Evaluation and Statistics Department of the Ministry of Health, for the data necessary for its mission of analyzing and disseminating statistical information in the health field. -The "Health Data Hub" health data platform and the "CNAM" to facilitate the use of health data for the needs of managing health emergencies and improving knowledge on virus, unless opposed by the person concerned might be disclosed to that authority in certain cases. What is the retention period for these data? The data is kept for 10 years to ensure all the obligations related to the traceability of the vaccination. The data necessary for No mentions in the CoranaImpfV, but some clarifications are made by The data shall be kept until at least 2 years after the death of the person to whom the vaccine was administered. Not disclosed. informing and referring to the vaccinated persons in the event of the appearance of a new risk linked to the vaccine are kept for 30 years in a dedicated database. the Länder which are in charge of the vaccination. What are the rights of the data subject? People remain free to enter the established vaccination circuit and be vaccinated against Covid-19. As such, people whose eligibility has been determined upstream by the compulsory health insurance bodies have the possibility of opposing the processing of this data as long as they have not entered the vaccination process, it is to say, as long as they have not benefited from a consultation prior to vaccination. No right to erasure according to Art. 17 (3) (c) GDPR. In addition, people who have entered the vaccination process may, at any time, oppose the transmission of their data for research purposes to the health data platform "Health Data Hub" and to the National Fund of health insurance. No mentions in the CoranaImpfV, but some clarifications are made by the Länder which are in charge of the vaccination. The rights of the data subjects are listed in the FADP (Art. 8 FADP regulates the right to information and Art. 15 and 25 FADP cover the right to bring legal claims). All data subjects have the right to access and rectify their data as well as the right to limit processing. Specific comments or concerns No transparency on the processors Interplay with Health Emergency State rules which create a lack of readability and predictability. No transparency regarding he processors, no clarification on the hosting of the data in Europe. Interestingly the prioritisation of the vaccination has been introduced in the CoranaImpfV. The Royal decree is too vague regarding the purposes and the controller and processor. Retention period too long. B.3. Detailed Analysis B.3.1. France B.3.1.1. The General Legal Context on Processing for Data Concerning Health.

  28 See: Loi relative à la protection des données personnelles[20 June 2018] No 2018-493.

  names, addresses and registration number in the INSEE's register of natural persons (so-called NIR) are not included in the SNDS. Only anonymised data is in open data. The access to personal data of the SNDS is limited to specific finalities and organisms under the conditions described in Art. L1461-3 of the CPH (Code of Health Data). 40 Some authors consider that this new legal context leads to a "major decompartmentalisation between care activities and research with other purposes than the direct interest of the person concerned". 41 This is at the core of the future implementation of the share medical data record, (dossier médical partagé) as the pictures below illustrate. Source: Rapport Assembée Nationale n°3231, Dossier médical partagé et santé, juillet 2020.

57

 57

  B.3.1.2. The Covid-19 Vaccination Campaign 58 Appointments to get vaccinated at a Covid-19 vaccination centre. 59 Appointments to the vaccination centres may be booked by the data subjects themselves or by a third party (either a doctor, a member of the family of the data subject, a person

60

  See: Ministère des Solidarités et de la Santé, 'Portofolio Vaccination Anti-Covid à destination des médecins et infirmiers' (2021) 5, <https://solidarites-sante.gouv.fr/grands-dossiers/vaccin-covid-19/je-suis-un-professionnel-de-sante-du-medico-social-etdu-social/article/guide-de-la-vaccination-pour-les-medecins-infirmiers> accessed 5 March 2021. 61 ibid 9, 17. 62 Alice Vitard, 'Covid-19 : les plateformes Doctolib, Maiia et Keldoc retenues pour la prise de rendez-vous pour la vaccination' (L'Usine Digitale, 12 January 2020), <https://www.usine-digitale.fr/article/covid-19-les-plateformes-doctolib-maiia-et-keldocretenues-pour-la-prise-de-rendez-vous-pour-la-vaccination.N1047779> accessed 5 March 2021.

63

  See: Julien Lausson, 'Doctolib et la vaccination : pourquoi les reproches de Mélenchon sont bancals' (Numerama, 12 January 2021), <https://www.numerama.com/sciences/681831-doctolib-et-la-vaccination-pourquoi-les-reproches-de-melenchon-sontbancals.html> accessed 5 March 2021.64 See: Doctolib, 'Communiqué de Presse -Vaccination contre la Covid-19 : Doctolib partenaire officiel de l'Etat pour la prise de rendez-<https://f.hubspotusercontent30.net/hubfs/5479688/B2B%20-%20Press/210111%20-%20CP%20Vaccination%20Doctolib%20(1).pdf> accessed 5 March 2021.

  65 C.f. Art. L1111-8 CPH.66 Agence du Numérique en Santé, 'Liste des Hébergeurs Certifiés' (eSanté, 2020), <https://esante.gouv.fr/labelscertifications/hds/liste-des-herbergeurs-certifies> accessed 5 March 2021. 67 By contrast, Maïa and Keldoc use a French host company: the Cegedim cloud for Maïa and OVH for Keldoc. 68 This is why recently the French Administrative Court has been seized. See: Alice Vitard, 'Covid-19 : Le partenariat pour la vaccination entre l'État et doctotolib attaqué en justice' (L'Usine Digitale, 1 March 2021) 68, <https://www.usinedigitale.fr/article/covid-19-le-partenariat-pour-la-vaccination-entre-l-etat-et-doctolib-attaque-en-justice.N1066499> accessed 5 March 2021. 68 Alice Vitard, 'L'Anssi certifie la solution Hosted Private Cloud d'OVH' (L'Usine Digitale, 12 January 2021), <https://www.usinedigitale.fr/article/l-anssi-certifie-la-solution-hosted-private-cloud-d-ovh.N1047709> accessed 5 March 2021.

76

  See: Délibération portant avis sur un projet de décret autorisant la création d'un traitement de données à caractère personnel relatif à la gestion et au suivi des vaccinations contre le coronavirus SARS-CoV-2 (demande d'avis n° 20020767) [10 December 2020] No 2020-126.

77 See :

 See Ministère des Solidarités et de la Santé, 'Organisation de la direction du numérique' (2020), <https://solidaritessante.gouv.fr/ministere/organisation/organisation-des-directions-et-services/article/organisation-de-la-direction-dunumerique-dnum> accessed 5 March 2021. 78 See: Art. 30 III, aAlinea 2 of the Arrêté prescrivant les mesures d'organisation et de fonctionnement du système de santé nécessaires pour faire face à l'épidémie de covid-19 dans le cadre de l'état d'urgence sanitaire [10 July 2020].

  Gleichstellung". The purposes and legal bases of data processing are detailed (first processed for the invitation and the arrangement of the vaccination appointments, registration in one of the six vaccination centres established by the State Berlin for the determination of the entitlement to vaccination, as well as for the documentation of your vaccination carried out at the vaccination centre, sending of invitation to vaccinate based on the information of the Berlin registrar

B. 3

 3 .3.2. The Processing of Data During the Covid-19 Vaccination Campaign 120 According to Art. 11 of the Law on 22 December 2020 regarding antigenic tests and the recording and treatment of data related to Covid-19 vaccines: 121 "The doctor or nurse who administers a Covid-19 vaccine or who supervises the vaccination registers each vaccination in the database designated by the Interministerial Conference on Public Health. The King specifies, by decree deliberated in the

122 See :

 See Autorité de la protection des données, Avis 138/2020 du 18 décembre 2020 relatif au projet d'arrêté royal concernant l'enregistrement et le traitement de données relatives aux vaccinations contre la Covid-19 (18 December 2020) n°12 et seq, <https://www.autoriteprotectiondonnees.be/publications/avis-n-138-2020-du-18-decembre-2020.pdf> accessed 5 March 2021.

B. 3

 3 .3.3. Proof of Vaccination as a Prerequisite to Access Some Services Point 7 of the online description of the system of information related to the Covid-19 vaccination mentions the delivery of a certificate of vaccination. "Any vaccinated person will be able to receive a printable electronic vaccination certificate for the Covid-19 vaccines. This certificate, which is quadrilingual (French, Dutch, German and English), contains the following information:  the NISS, the surname, first name, sex, date of birth and nationality of the certificate holder  the indication of the Belgian State as the issuer of the certificate for any vaccination  the name of the vaccine  the date of vaccination As soon as a standard certificate model is defined by the WHO, it will be used." 130 B.3.4. Switzerland Dr Alexia Pato B.3.4.1. The Legal Framework for the Processing of Sensitive Personal Data

----------------

  Council of Europe, Joint Statement on the right to data protection in the context of the COVID-19 pandemic by Alessandra Pierucci, Chair of the Committee of Convention 108 and Jean-Philippe Walter, Data Protection Commissioner of the Council of Europe (30 March 2020), <https://www.coe.int/en/web/data-protection/statement-by-alessandra-pierucci-and-jeanphilippe-walter> accessed 5 March 2021. -Council of Europe, Recommendation CM/Rec (2015)5 of the Committee of Ministers to Member States on the processing of personal data in the context of employment, adopted by the Committee of Ministers on 1 April 2015 at the 1224 th meeting of the Ministers' Deputies. Loi du 15 janvier 1990 organique de la Banque Carrefour de la Sécurité Sociale [15 January 1990] No 1990/022014. Arrêté royal concernant l'enregistrement et le traitement de données relatives aux vaccinations contre la COVID-19 [24 December 2020] No 2020/205675.Loi du 21 août 2008 relative à l'institution et à l'organisation de la plate-forme eHealth et portant dispositions diverses [13 October 2008] No 2008/022534. Loi du 3 décembre 2017 portant création de l'Autorité de protection des données [3 December 2018] No 2017/031916. Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel [5 September 2018] No 2018/040581. Loi du 5 septembre 2018 instituant le comité de sécurité de l'information et modifiant diverses lois concernant la mise en oeuvre du Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE [10 September 2018] No 2018/203892. Loi du 22 décembre 2020 portant diverses mesures relatives aux tests antigéniques rapides et concernant l'enregistrement et le traitement de données relatives aux vaccinations dans le cadre de la lutte contre la pandémie de COVID-19 [4 January 2021] No 2020/044633. Publications -Thierry Fiorilli, 'Et si je refuse le vaccin?', Le Vif (Brussels, 7 January 2021), <https://www.levif.be/actualite/sante/covid-et-si-je-refuse-le-vaccin/article-normal-1376961.html> accessed 5 March 2020. -Loick Gérard, 'Le Comité de sécurité de l'information : illustration d'une incohérence législative' www.crid.be/pdf/public/8466.pdf> accessed 5 March 2021. -Cécile de Terwangne and Elise Degrave (with the collaboration of Antoine Delforge and Loick Gérard), Protection des données à caractère personnel en Belgique. Manuel de base (Politeia 2019). Autorité de la protection des données, Avis 138/2020 du 18 décembre 2020 relatif au projet d'arrêté royal concernant l'enregistrement et le traitement de données relatives <https://www.autoriteprotectiondonnees.be/publications/avis-n-138-2020-du-18-decembre-2020.pdf> accessed 5 March 2021. www.ehealth.fgov.be/fr/esante/information-vaccination/description-des-bases-de-donnees> accessed 5 March 2021. -Ma santé, <https://masante.belgique.be/#/> accessed 5 March 2021. Articles -Jean-Ferdinand Puyraimond, 'Some Thoughts about the Belgian Data Protection Authority' /blogdroiteuropéen.files.wordpress.com/2018/06/jean.pdf> accessed 5 March 2021.France Laws and Regulations -Arrêté modifiant l'arrêté du 10 juillet 2020 prescrivant les mesures générales nécessaires pour faire face à l'épidémie de covid-19 dans les territoires sortis de l'état d'urgence sanitaire et dans ceux où il a été prorogé [9 October 2020]. Arrêté prescrivant les mesures d'organisation et de fonctionnement du système de santé nécessaires pour faire face à l'épidémie de covid-19 dans le cadre de l'état d'urgence sanitaire [10 July 2020]. -Arrêté complétant l'arrêté du 23 mars 2020 prescrivant les mesures d'organisation et de fonctionnement du système de santé nécessaires pour faire face à l'épidémie de covid-19 dans le cadre de l'état d'urgence sanitaire [21 April 2020]. -Décret autorisant la création d'un traitement de données à caractère personnel relatif aux vaccinations contre la Covid-19 [25 December 2020] No 2020-1690. -Décret modifiant le décret n° 2020-551 du 12 mai 2020 relatif aux systèmes d'information mentionnés à l'article 11 de la loi n° 2020-546 du 11 mai 2020 prorogeant l'état d'urgence sanitaire et complétant ses dispositions [14 November 2020] No 2020-1385. -Décret fixant la liste des professionnels de santé habilités à renseigner les systèmes d'information mentionnés à l'article 11 de la loi du 11 mai 2020 prorogeant l'état d'urgence sanitaire et complétant ses dispositions [14 November 2020] No 2020-1387. -Décret relatif au traitement de données dénommé STOPCOVID [29 May 2020] No 2020-650. -Décret relatif aux systèmes d'information mentionnés à l'article 11 de la loi n° 2020-546 du 11 mai 2020 prorogeant l'état d'urgence sanitaire et complétant ses dispositions [12 May 2020] No 2020-551. -Loi de modernisation de notre système de santé [26 January 2016] No 2016-41. -Loi relative à l'organisation et à la transformation du système de santé [24 July 2019] No 2019-774. Loi prorogeant l'état d'urgence sanitaire et complétant ses dispositions [11 May 2020] No 2020Assemblée nationale française -Commission des affaires sociales, 'Rapport d'information n°3231, sur le dossier médical partagé et les données de santé' (22 July 2020), <https://www.assemblee-nationale.fr/dyn/15/rapports/cion-soc/l15b3231_rapport-information> accessed 5 March 2021. -Conseil d'État, 'Avis Section sociale n° 40174 Sur un projet de loi instituant un reǵime peŕenne de gestion des urgences sanitaires', <https://www.assembleenationale.fr/dyn/15/textes/l15b3714_avis-conseil-etat.pdf> accessed 5 March 2021. -Ministère des Solidarités et de la Santé, 'Ma santé 2022 : un engagement collectif' (2020), <https://solidarites-sante.gouv.fr/systeme-de-sante-et-medico-social/masante2022/> accessed 5 March 2021. Ministère des Solidarités et de la Santé, 'Organisation de la direction du numérique' (2020), <https://solidarites-sante.gouv.fr/ministere/organisation/organisation-des-directions-etservices/article/organisation-de-la-direction-du-numerique-dnum> accessed 5 March 2021. Ministère des Solidarités et de la Santé, 'Portofolio Vaccination Anti-Covid à destination des médecins et infirmiers' (2021), <https://solidarites-sante.gouv.fr/grands-dossiers/vaccin-covid-19/je-suis-un-professionnel-de-sante-du-medico-social-et-du-social/article/guide-de-lavaccination-pour-les-medecins-infirmiers> accessed 5 March 2021. -Ministère des Solidarités et de la Santé, 'Lieux de vaccinations COVID-19' (2020), <https://www.sante.fr/cf/centres-vaccination-covid.html> accessed 5 March 2021. CNIL Délibérations Délibération portant adoption d'un référentiel relatif aux traitements de données à caractère personnel mis en oeuvre à des fins de gestion des vigilances sanitaires [9 May 2019] No 2019-057. Délibération portant adoption de lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture et écriture dans le terminal d'un utilisateur [17 September 2020] No 2020-091. -Délibération portant adoption d'une recommandation proposant des modalités pratiques de mise en conformité en cas de recours aux «°cookies et autres traceurs°» [17 September 2020] No 2020-092. -Délibération SAN-2020-014 [7 December 2020]. -Délibération de la formation restreinte SAN-2020-015 [7 December 2020]. -Délibération portant avis sur un projet de décret autorisant la création d'un traitement de données à caractère personnel relatif à la gestion et au suivi des vaccinations contre le coronavirus SARS-CoV-2 [10 December 2020] No 2020-126.-Délibération portant avis public sur les conditions de mise en oeuvre des systèmes d'information développés aux fins de lutter contre la propagation de l'épidémie de COVIDwww.cnil.fr/sites/default/files/atoms/files/guide_pratique_circuits_nir_recherche_en_s ante.pdf> accessed 5 March 2021.

  This has been recalled by the EDPB in statements on the processing of personal data in the context of the Covid-19 outbreak,16 and can be applied by analogy to the Covid-19 vaccination.A.3.3. Room for Manoeuvre Left to the European States for the Covid-19 VaccinationThe GDPR contains several opening clauses, 17 which allow the possibility for Member States to add specifications to the legal framework of the processing of data related to health. First, Art. 9 (4) GDPR declares that "Member States may maintain or introduce further conditions including limitations, with regard to (…) data concerning health". Second, Art. 23 (1) (e) GDPR 18 authorises Member State to adopt restrictions to data protection principles and data subject rights to safeguard "(…) other important objectives of general public interest of the Union or of a Member State including public health (…)".

  Ministère des Solidarités et de la Santé, 'Ma santé 2022 : un engagement collectif' (2020), <https://solidaritessante.gouv.fr/systeme-de-sante-et-medico-social/masante2022/> accessed 5 March 2021.37 See Art. L1462-1 and et seq of the Code of public Health. /www.cnil.fr/sites/default/files/atoms/files/guide_pratique_circuits_nir_recherche_en_sante.pdf> last accessed 5 March 2021.

	38 See Art. L1461-1 to 1461-7 of the Code of public Health.
	39 Bruno Py and Valérie Olech (n 32), 149.
	40 The CNIL recently published a practical guide on the modalities of circulation of the NIR for the research in the health sector
	with	purposes	of	data-matching	with	the	SNDS,	available	at:
	<https:/

34 Loi de modernisation de notre système de santé [26 January 2016] No 2016-41.

35

Loi relative à l'organisation et à la transformation du système de santé [24 July 2019] No 2019-774.

36

See:

  Beyond the discrimination issue that the creation such a Covid-19 Passport would generate, the President of the French Republic implied an indirect but clear obligation to be vaccinated. Above all, as argued by the President of the "Haute Autorité de Santé", it is not clear that it will be efficient because there is no proof that the vaccines

	block transmission.
	B.3.2. Germany
	B.3.2.1. The General Legal Context on Processing of Data Concerning Health 82

  number, E-mail address, gender, street, house number, postcode, city, place of appointment, type of appointment (first or follow-up vaccination) if applicable. Indication of mobility impairment, if applicable, required aids (such as wheelchair, guide dog, legal guardian), if applicable, indication for the entitlement to the vaccination against the SARS-CoV-2 coronavirus. Appointment reminders by email or SMS are possible with the consent of the data subject. In this case, the data subject is informed of the possibility to withdraw his consent. The data which can be processed during the registration and the identification at the vaccination centre are listed, as well as what the information regarding the vaccination collected by the doctors is. Information on the retention of data .3.3. Belgium B.3.3.1. The General Legal Context on the Processing of Data Concerning Health

). The following data is processed: name, first name, surname at birth, date of birth, current registration address, agreement of vaccination appointments, the arrangement of appointments can be made either by telephone or by using online contact form. In both procedures, the following personal data are processed: vaccination code, name, first name, maiden name, date of birth, mobile phone number, fixed line phone

104

Berlin, 'Impftermin online buchen' (2020), <https://service.berlin.de/corona/artikel.1034107.php> accessed 5 March 2021

105

See: https://service.berlin.de/corona/schutzimpfung_datenschutzinformation_20201224.pdf. B

  .B.3.4.2. The Vaccination Campaign Against Covid-19 Two vaccines have been recently approved in Switzerland (the Moderna and the Comirnaty vaccines).134 It is estimated that a total of 10,5 million doses have been ordered. The Federal Office of Public Health (FOPH) has established an order of priority, according to which vulnerable persons shall be vaccinated first. Those persons include people age 75 and over, people with chronic diseases of the highest risk 135 (regardless of their age) and people who live in a retirement or care home. Staff who are in contact with residents of retirement and care homes also have the option of being vaccinated at the same time. Note that further prioritisation is necessary within that group, as not enough doses of vaccine are available for the time being.

  /www.gef.be.ch/gef/de/index/direktion/organisation/alba/aktuell/Newsletter_ALBA6.assetref/dam/documents/GEF/ALB A/fr/Coronavirus/Declaration_de_consentement.pdf> accessed 5 March 2021. However, statements remain quite general;

	Canton	de	Berne,	'Dećlaration	de	consentement	concernant	l'application	en	ligne	VacM'	(2021),
	<https:/

  Regulation (EU) 2016/679 of 28 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR),OJ L 119, 4.5.2016, 1-88.

	Bibliography General Books -Conseil d'État, Santé et protection des données : Un colloque organisé par le Conseil d'État le 1 er -Official Sources
	décembre 2017 (La Documentation française 2021).
	-Council of the EU, 'Oral conclusions drawn by President Charles Michel following the video
	-Council of Europe, Digital Solutions to Fight Covid-19. 2020 Data Protection Report (October conference of the members of the European Council on 21 January 2021' (2021),
	2020), <https://rm.coe.int/prems-120820-gbr-2051-digital-solutions-to-fight-covid-19-text-a4-<https://www.consilium.europa.eu/media/47296/1011-12-20-euco-conclusions-en.pdf>
	web-/16809fe49c> accessed 5 May 2021 accessed 5 March 2021.
	-Guerino Massimo Fares and Guido Scorza (eds), The Protection of Personal Data Concerning
	Health at the European Level: A Comparative Analysis (Giappichelli 2021).
	-Rita Rio-Tinto, Protection des données relatives à la santé : Perception et connaissances des
	administrateurs d'hôpitaux concernant le nouveau règlement général de l'UE sur la protection des
	données (Editions Notre Savoir 2020).
	PhD Theses
	-Christina Koumpli, Les données personnelles sensibles. Contribution à l'évolution du droit
	fondamental à la protection des données à caractère personnel (Université Paris 1 Panthéon-
	Sorbonne 2019).
	Book Contributions
	-Guerino Massimo Fares, 'The Processing of Personal Data Concerning Health According to the
	EU Regulation', in Guerino Massimo Fares and Guido Scorza (eds), The Protection of Personal
	Data Concerning Health at the European level. A Comparative Analysis (Giappichelli 2021) 17-49.
	-Pierre Trudel, 'La protection de la vie privée dans les systèmes d'information relatifs à la santé.
	Ajuster les concepts aux réalités des réseaux', in Christian Hervé, Barbara-Maria Knoppers and
	Patrick A. Molinari (eds), Les pratiques de recherche biomédicales visitées par la bioéthique (Dalloz
	2003) 163-176.

-Aïssatou Sarr, Quel équilibre entre la protection des données et la santé ? Comment respecter la réglementation sans limiter le développement de la recherche clinique (Editions universitaires européennes 2017).

-Olivia Tambou, Manuel de droit européen de la protection des données à caractère personnel (Bruylant 2020).

-Caroline Zorn Macrez, Données de santé et secret partagé : Pour un droit de la personne à la protection de ses données de santé partagées (Presses universitaires de Nancy 2010).

-Renatto Brasselet, La circulation de la donnée à caractère personnel relative à la santé (Université de Lorraine 2018).

  Statement by President von der Leyen at the joint press conference with President Michel, following the videoconference of the members of the European Council, on 25 February, Council of Europe, Recommendation CM/Rec (2019)2 of the Committee of Ministers to Member States on the protection of health-related data, adopted by the Committee of Ministers on 27 March 2019 at the 1342 nd meeting of the Ministers' Deputies. ://www.echr.coe.int/Documents/FS_Data_ENG.pdf> accessed 5 March 2021.

	Council of Europe References
	--ECHR	Factsheet	on	Personal	Data		Protection	(October	2020),
	March 2021.
	-eHealth Network, Guidelines on verifiable vaccination certificates -basic interoperability
	elements	-		Release		2		(3	March	2021),
	<https://ec.europa.eu/health/sites/health/files/ehealth/docs/vaccination-
	proof_interoperability-guidelines_en.pdf> accessed 5 May 2021
	-eHealth Network, Guidelines on proof of vaccination for medical purposes-basic
	interoperability	elements,	V1.1,	2021,	01	(27)	(12	March	2021),
	<https://ec.europa.eu/health/sites/health/files/ehealth/docs/vaccination-
	proof_interoperability-guidelines_en.pdf> accessed 5 March 2021.
	Cases
	CJEU
	-Case-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems,
	[2020] ECLI:EU:C:2020:559.
	-Case-101/01, Bodil Lindqvist, [2003] ECLI:EU:C:2003:596
	ECtHR
	-I.	v	Finland,		App.	no	20511/03,	17	July	2008,
	https://hudoc.echr.coe.int/ENG#{%22itemid%22:[%22003-2418491-2618211%22]} accessed
	29 March 2021.

<https://ec.europa.eu/commission/presscorner/detail/en/STATEMENT_21_861> accessed 5 <https

A first version of this report has been sent to the Luxembourg Ministry of Health in January

The present report includes a small update from 4 March 2021 for the purpose of the publication as a research paper for the Max Planck Institute Luxembourg for Procedural Law. Neither author has any competing interests or special funding to declare.

A first version of this report has been sent to the Luxembourg Ministry of Health in January

The present report includes a small update from 4 March 2021 for the purpose of the publication as a research paper for the Max Planck Institute Luxembourg for Procedural Law.

See: European Commission, A European Strategy for Data, COM(2020) 66 final (19 February 2020), esp. Annex point

The definition of health-related data is also used in the recent Recommendation CM/Rec (2019)2 of the Committee of Ministers to Member States on the protection of health-related data adopted by the Committee of Ministers on 27 March 2019 at the 1342 nd meeting of the Ministers' Deputies, seeArt. 3.

The former Council Directive 95/46 of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281) did not entail a definition of the concept of data related to health. However, the CJEU gave a first interpretation of the concept saying, "in the light of the purpose of the expression data concerning health used in Article 8(1) must be given a wide interpretation so as to include information concerning all aspects, both physical and mental, of the health of an individual." See: Case-101/01, Bodil Lindqvist, ECLI:EU:C:2003:596, para. 50. In this case, the CJEU concluded that "the reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal data concerning health" (para. 51).

Thibault Douville, 'Les dangers de la collecte des données de santé par les tiers intéressés' (2018) 20 JDSAM 12; Rémi Decout-Paolini, 'La définition des données de santé', in Conseil d'État (ed.), Santé et protection des données (La Documentation Française 2021) 29.

 7 See, for instance, the Website of the CNIL available at: <https://www.cnil.fr/fr/quest-ce-ce-quune-donnee-de-sante> accessed 5 March 2021.

See EDPB, Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the Covid-19 outbreak, adopted on 21 April 2020.

For a global analysis of the relevance of the ECtHR in the area of Health processing, see: Guerino Massimo Fares, 'The Processing of Personal Data Concerning Health According to the EU Regulation', in Guerino Massimo Fares and Guido Scorza (eds), The Protection of Personal Data Concerning Health at the European Level. A Comparative Analysis' (Giappichelli 2021) 32.

I. v Finland, App no 20511/03 (ECtHR 17 July 2008) §38.

It should be underlined that the data protection principles are also provided by the Law of the Council of Europe in particular through the Convention 108 which has been ratified by 55 States including third countries from Latin America and Africa. This

See: EDPB, Statement on the processing of personal data in the context of the COVID 19 outbreak, adopted on 19 March 2020, 1-2; EDPB, Statement on the processing of personal data in the context of reopening of borders following the Covid-19 outbreak, adopted on 16 June 2020, 2.

See: Julian Wagner and Alexander Benecke, 'National Legislation within the Framework of the GDPR' (2016) 2(3) European Data Protection Law Review 353.

On Art. 23 GDPR see: EDPB, Guidelines 10/2020 on restrictions under Art. 23 GDPR, adopted on 15 December 2020.

See Art. 89 (1) GDPR which mentions the application of technical and organisational measures, pseudonymization.

See: eHealth Network, Guidelines on proof of vaccination for medical purposes-basic interoperability elements, V1.1, 2021, 01 (27) (12 March 2021), <https://ec.europa.eu/health/sites/health/files/ehealth/docs/vaccination-proof_interoperability-guidelines_en.pdf> accessed 5 March 2021.

 22 The eHealth Network is a voluntary network set up under art. 14 of Directive 2011/24 EU, which provides a platform of Member States competent authorities dealing with eHealth

.23 Council of the EU, 'Oral conclusions drawn by President Charles Michel following the video conference of the members of the European Council on 21 January 2021' (2021), <https://www.consilium.europa.eu/media/47296/1011-12-20-euco-conclusionsen.pdf> accessed 5 May

2021.

 24 ibid.25 eHealth Network, Guidelines on verifiable vaccination certificates -basic interoperability elements -Release 2 (3 March 2021), <https://ec.europa.eu/health/sites/health/files/ehealth/docs/vaccination-proof_interoperability-guidelines_en.pdf> accessed 5 May 2021.

See: CNIL, Délibération portant avis public sur les conditions de mise en oeuvre des systèmes d'information développés aux fins de lutter contre la propagation de l'épidémie deCOVID-19 [14 January 2021] No 2021-004.

For instance, the option provided byArt. 23 (1) (e) GDPR has not been implemented in French law. This means that the rights of the data subject are not limited for important objectives of general public interest of public health.

This has been elaborated by the CNIL.

Délibération portant adoption d'un référentiel relatif aux traitements de données à caractère personnel mis en oeuvre à des fins de gestion des vigilances sanitaires [9 May 2019] No 2019-057.

See: Six méthodologies de références (MR) adopted by the CNIL for easing the conformity of the processing for research purposes, studies and evaluation in the health sector, available at: <https://www.cnil.fr/fr/traitements-declarationconformite?field_norme_numerotation_type_value%5B0%5D=6> accessed 5 March 2021

 33 See: Bruno Py and Valérie Olech, 'Impact of EU Regulation 2016/679 on the French Health System', in Guerino Massimo Fares and Guido Scorza (eds), The Protection of Personal Data Concerning Health at the European Level. A Comparative Analysis (Giappichelli 2021) 143.

Gilles Triolier, 'Frappé par une cyberattaque massive, le CHU de Rouen forcé de tourner sans ordinateurs' Le Monde (Paris, 18 November 2019), <https://www.lemonde.fr/pixels/article/2019/11/18/frappe-par-une-cyberattaque-massive-le-chu-de-rouenforce-de-tourner-sans-ordinateurs_6019650_4408996.html> accessed 5 March 2021.

43 Alice Vitard, 'Doctolib victime d'un vol de données personnelles concernant plus de 6 000 rendez-vous médicaux' (L'Usine Digitale, 23 July 2020), <https://www.usine-digitale.fr/article/doctolib-victime-d-un-vol-de-donnees-personnelles-concernantplus-de-6-000-rendez-vous-medicaux.N988404> accessed 5 March

2021.44 See: Délibération No SAN-2020-014 [7 December 2020] and Délibération de la formation restreinte No SAN-2020-015 [7 December 2020] in which the CNIL imposed two fines of EUR 3.000 and EUR 6.000 against two liberal doctors for insufficiently protecting the personal data of their patients and failing to notify a data breach to the CNIL.

www.cnil.fr / CNIL -3, Place de Fontenoy TSA-80715-75334 PARIS CEDEX 07.

See: Datenschutz, 'Datenschutz wird bei Corona-Impfungen gewahrt -Kugelmann sieht keine Bedenken gegen Impfungen' (2020), <https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/datenschutz-wird-bei-corona-impfungengewahrt-kugelmann-sieht-keine-bedenken-gegen-impfungen> accessed 5 March 2021.

 101 In Rhineland-Palatinate, the state, represented by the Ministry of Social Affairs, Labor, Health and Demography has set up a total of 31 vaccination centres. Coronavirus vaccination appointments at one of the vaccination centres in Rhineland-Palatinate can be made by submitting a form. Information and advice on vaccination can be found at: <www.corona.rlp.de> or by calling the vaccination advice line on 0800-5758100. See: <https://impftermin.rlp.de

/>.102 Deutsche Welle, 'COVID vaccination: Germans struggling to get appointments' (2020), <https://www.dw.com/en/covidvaccination-germans-struggling-to-get-appointments/a-56195066> accessed 5

March 2021. 103 Datenschutz, 'FAQ' (2020) <https://www.datenschutz.rlp.de/de/themenfelder-themen/corona-datenschutz/#c3830> accessed 5 March 2021.

See: Doctolib, 'Datenschutzhinwiese für Patienten' (2020), <https://www.doctolib.de/terms/agreement> accessed 5 March 2021.

Created in 2007, the German Ethics Council is an independent council of experts which is mandated for informing the public, preparing opinions and recommendations for political and legislative action in particular at the request of the German Bundestag or the German Federal Government.

See: Deutscher Ethikrat, 'Ad Hoc Recommendation -Special Rules for Vaccinated People?' (4 February 2021), <https://www.ethikrat.org/fileadmin/Publikationen/Ad-hoc-Empfehlungen/englisch/recommendation-special-rules-forvaccinated-people.pdf> accessed 5 March 2021.

 109 See ibid 5.

For more details on Belgian law on data protection, see: Cécile de Terwangne and Elise Degrave (with the collaboration of Antoine Delforge and Loick Gérard), Protection des données à caractère personnel en Belgique. Manuel de base (Politeia 2019).

Jean-Ferdinand Puyraimond, 'Some Thoughts about the Belgian Data Protection Authority' (blogdroiteuropéen, 14 June 2018), <https://blogdroiteuropéen.files.wordpress.com/2018/06/jean.pdf> accessed 5 March 2021.

Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel [5 September 2018] No 2018/040581.

Loi du 5 septembre 2018 instituant le comité de sécurité de l'information et modifiant diverses lois concernant la mise en oeuvre du Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE [10 September 2018] No 2018/203892.

On this specificity, see: Loick Gérard, 'Le Comité de sécurité de l'information : illustration d'une incohérence législative' (2019) 73 Revue du Droit des Technologies de l'Information 55-72, <http://www.crid.be/pdf/public/8466.pdf> accessed 5 March 2021.

See the last deliberation of the Committee available at: <https://www.ehealth.fgov.be/ehealthplatform/fr/comitesectoriel/documents>.

Arrêté royal concernant l'enregistrement et le traitement de données relatives aux vaccinations contre la COVID-19, [24 December 2020] No 2020/205675.

In agreement with the Belgian Data Protection Authority, see: Autorité de la protection des données (n 121) 28.

ibid. No 42.

ibid. No 43. This right exists in Belgium in relation to the National Registry.

See <https://www.ehealth.fgov.be/fr/esante/information-vaccination/description-des-processus>.

Note that a revised version of the FADP has been adopted on 25 September 2020 by the Swiss Parliament. The text, which should enter into force in 2022, is available at: <https://www.fedlex.admin.ch/eli/fga/2020/1998/fr>.

Art. 3(c) FADP: "The following definitions apply: (…) (c) sensitive personal data: data on: 1. religious, ideological, political or trade union-related views or activities, 2. health, the intimate sphere or the racial origin, 3. social security measures, 4. administrative or criminal proceedings and sanctions".

Defined as the federal authority or service, as well as the person entrusted with a task of the Confederation.

ibid.

Fondation mesvaccins, 'Privacy Policy' (2020), <https://www.myvaccines.ch/privacy.do?locale=en> accessed 5 March 2021.

Note that a revised version of the FADP has been adopted on 25 September 2020 by the Swiss Parliament. The text, which should enter into force in 2022, is available at <https://www.fedlex.admin.ch/eli/fga/2020/1998/fr> accessed 5 March 2021.

Report 2 Beyond this legal framework, the security and the confidentiality on health processing raises several practical concerns. Hospitals 42 and providers of digital health services 43 are facing cyberattacks, which can take the form of ransomware attacks. The activities of the CNIL demonstrate that even health professionals are failing to protect the confidentially of the health data they collect. 44 This shows that the information [START_REF]CNIL and Conseil de l'Ordre National des Médecins[END_REF] and the training on data protection for the medical sector need to be improved.

The impact of the Covid-19 outbreak on health data processing During the outbreak of the Covid-19 pandemic, several measures have been taken within the framework of the state of health emergency [START_REF]Data protection issues related to Covid-19 in France part one: issues on health data processing', econference on data protection issues and Covid-19 hosted by blogdroiteuropéen[END_REF] . First, the implementation of the French Health Data Hub was anticipated for the management of the health emergency and the improvement of the knowledge on the virus. [START_REF]23 mars 2020 prescrivant les mesures d'organisation et de fonctionnement du système de santé nécessaires pour faire face à l'épidémie de covid-19 dans le cadre de l'état d'urgence sanitaire[END_REF] The hosting of the Health Data Hub by a branch of Microsoft raised considerable criticisms [START_REF] Fallery | Données de santé : l'arbre StopCovid qui cache la forêt Health Data Hub[END_REF] and concerns. [START_REF]face à l'épidémie de covid-19 dans les territoires sortis de l'état d'urgence sanitaire et dans ceux où il a été prorogé[END_REF] Source: B. Fallery, the Conversation of all authorities for the public and the private sectors has been established -the Data Protection Conference ("Datenschutzkonferenz" (DSK)). 86 Constitutional aspects of the interplay between national and EU laws in data protection. As far as the German adaptation to the GDPR is concerned, scholars are very critical and consider that it raises several concerns. First, Germany has made extensive use of its "room for manoeuvre" [START_REF] See | The New Federal Data Protection Act -Implementation of the GDPR in Germany[END_REF] . Second, some

German provisions are too vague to comply with the GDPR requirements, in particular the ones establishing safeguard measures that ensure the rights and freedoms of data subjects. It is therefore most likely that the German Constitutional Court ("Bundesverfassungsgericht" (BVerfG)) will be asked to adjudicate on data protection issues. In addition, it should be underlined that the BVerfG considers that it should have the last word as to whether German authorities apply EU legislation on the basis of EU fundamental rights. The rationale behind this constant [START_REF] Petersen | Mandat d'arrêt européen et opérations monétaires sure titres : la jurisprudence de law cour constitutionnelle allemande part.2[END_REF] and strong position [START_REF] Ziller | L'insoutenable pesanteur de juge constitutionnel allemand[END_REF] is that, through this testing, "no gaps in fundamental rights protection" 90 will occur. This can have a specific impact on the interpretation of the GDPR and in particular on Germany's uses of its open clauses.

The complex interplay between the GDPR and the Sozialgesetzbuch (SGB). The German legal framework on the processing of data concerning health is not to be found in the BDSG but in specific health and social security laws (SGB). The main difficulty is that the SGB relies on the concept of social data ("Sozialdaten") and not on health data. According to § 67, sec. 2 SGB-X, data concerning health in the sense of Art. 9 GDPR is subsumed under the terminology of social data. Consequently, this creates a lack of visibility and understanding of the status of the data related to health in Germany. Furthermore, § 35, sec. 3 SGB-I provides that the SGB applies to social data unless the GDPR applies directly. In addition, this provision clarifies that outside the scope of application of the GDPR, the SGB provides the relevant legal ground for the processing of social data.

Whereas the SGB-X does not provide a legal ground to introduce further conditions with regard to the processing of special sets of health data according to Art. 9 (4) GDPR, some provisions of the SGB

86

A list of all Data Protection Authorities in Germany is available at: <https://www.datenschutzkonferenzonline.de/datenschutzaufsichtsbehoerden.html> accessed 5 March 2021. is provided. Data will be stored for as long as it is required for the above-mentioned purposes, but at the longest for a period of 10 years in accordance with the medical documentation obligation.

By contrast to this clear information, the section of transfer to third parties and the possible recipients lacks detail. No list of the subcontractors is available. However, a list of subcontractors can be requested from the Senate Department for Health, Nursing and Equal Opportunities. Furthermore, there is no mention about possible data transfers to third countries. Doctorlib.de's website clarifies that "to comply with the personal health data provisions of the French Public Health Code, Doctolib uses Amazon Web Services to host the health data (HDS certified)". 106 The centralisation of the pseudonymised data at the Robert-Koch-Institut (RKI). § 7 of the CoronaImpfV specifies that the pseudonymised data of the regional vaccination centres have to be transferred to the RKI. The data collected by the RKI are only processed for the purpose of determining the use of protective vaccinations and vaccination effects (vaccination surveillance). The RKI shares these data with the Paul Ehrlich Institute as well, which processes it only for the purpose of monitoring the safety of vaccines (pharmacovigilance).

B.3.2.3 Proof of Vaccination as a Prerequisite to Access Some Services

To the best of this author's knowledge, there is no official position of German Federal Government on the Covid-19 vaccine certificate. Nevertheless, the German Ethics Council 107 adopted an ad hoc recommendation on whether vaccination against Covid-19 may or even must lead to special rules for vaccinated people in February 2021 108 . In this document the German Ethics Council does not recommend individual withdrawal of state restrictions on civil liberties for vaccinated persons at this stage. Furthermore, the German Ethics Council considers that "Only insofar as the access to offers of private providers is in-dispensable for a generally equal, basic social participation, is it illegitimate to restrict access to such offers in favour of vaccinated persons." 109 -Marie-Claire Ponthoreau, 'La protection des personnes contre les abus de l'informatique. À propos de la loi du 1er juillet 1994 relative au traitement des données nominatives ayant pour fin la recherche dans le domaine de la santé' (1996) Revue française de droit administratif 796-808.

-Yves Poullet, 'Pandémie, numérique et droits de l'homme -un étrange cocktail !' (2020) 270 Journal de droit européen 246-263.

-Olivia Tambou, 'L'invalidation du Privacy Shield : peut-on sortir des turbulences dans les flux transatlantiques des données à caractère personnel ? (obs. sous C.J.U.E., Gde Ch., arrêt