Festivals, discos, fairs, trade shows ... The health pass is increasingly seen by the executive as a tool to keep the epidemic under control.
But does this device endanger your personal data?
This Tuesday, the Council of State will have to look into this complex question, on the occasion of an appeal filed by the association for the defense of freedoms La Quadrature du net, in mid-June.
To discover
Health pass: documents to provide, places concerned ... Answers to all your questions
Read also: Health pass: the rule that irritates festivals
As a reminder, the health pass aims to prove that individuals wishing to access a place are not contaminated or are vaccinated against Covid-19. It is checked thanks to the “
TousAntiCovid Verified
”
application
: once its QR code has been scanned, it indicates the name and first name of the individual as well as his date of birth. At the same time, the controller must "
require the presentation of an identity document
", in order to ensure that the person shows his health pass, and not that of another. No data scanned during the control is kept, specifies the government.
For La Quadrature du net, this system presents flaws and risks, in particular for the personal data of individuals.
Several arguments are advanced.
First, it limits access to only people with an identity document.
A first point disputed by the association: "
our identity is proven by any means [...].
Possession of an identity card should not be imposed more than it is today
", considers the organization, which calls for the health crisis not to be a"
pretext to restore the 'general obligation to hold an identity document, as imposed by the Vichy government
”.
Risk to personal data
In addition, the health pass presents a risk for the personal data of individuals, argues La Quadrature du net. The QR code on the pass contains information relating to the civil status of individuals, as well as their state of health. If the TousAntiCovid Verified application only allows access to a fragment of this information, when the code is scanned, all of this data can still be used by malicious minds, warns the association.
"
The health passes issued contain [...] information relating to the civil status of persons as well as their state of health, this information being readable without restriction by any third party reading the two-dimensional code contained on these passes
”explains the organization. Thus, a pass obtained following a vaccination contains, in its code, "
the date of issue of the document [...] the name, first names, date of birth of the person vaccinated, [...] ] the name of the vaccine and its manufacturer, the number of injections made [...] and the number of injections required to have complete vaccine protection
, ”she lists in her appeal.
However, for the organization, any malicious individual could develop an application resembling like two drops of water to that of the government to read the sanitary passes, at the entrance of a place, and to record all their information, well beyond what TousAntiCovid Verified does, explains Bastien Le Querrec. “
To demonstrate the ease with which we can build files using these passes, we developed an application in one day,
” says the member of the association. The latter functioned like the government one, scanning codes, but it discreetly recorded the information and exported it to a file "
outside the reader application
".
All this information is sensitive and sometimes expensive: a young person requiring three injections can thus be identified as immunocompromised and at risk, for example. "
There is a real interest in our health data, they are sought after and provide precise and useful information, for example for banks or insurance companies
", comments Bastien Le Querrec.
The pass also risks limiting the freedom to come and go, notes the appeal: individuals wishing to “
protect themselves against this violation
” of their privacy could limit their movements to places where this device is required.
Finally, personal data "
can be cross-checked with the place, date and time of reading
" of the pass, creating a risk of recording the movements of the population.
The population is thus "
vulnerable to forms of surveillance [...] and the creation of illicit files
".
Suspension of health pass requested
La Quadrature du net therefore requests that the health pass as it exists be suspended immediately. She pleads for it to understand, as information, only if the individual has "
one of the three required documents (certificate of recovery, vaccination certificate, RT-PCR test)
", and until when these are valid, but no other information of any kind, including his identity. "
We have to trust each other
", and that everyone assumes that everyone will present their health pass, and not that of others, which makes identity checks and additional information superfluous, pleads Bastien Le Querrec .
The other data "
are not necessary
", argues the association, and they are too sensitive to appear on a code: "
the fact that we are, by law, obliged to go through TousAntiCovid Verified [to scan the code, Editor's note] is absolutely not going to prevent a malicious person from using another application similar to this one
”, to collect all the data of the QR code, worries the representative.
The case will be studied Tuesday by the Council of State, which could take longer than the usual two days to render its decision.
The Ministry of Health unsurprisingly opposed the association's request, without the details of the arguments being known.