Interview: Privacy Rights Advocacy Group Raises Concerns About Digital Access To Vaccine Records

A privacy rights advocacy group is raising concerns about California’s program giving residents digital access to their coronavirus vaccination records. 

Last week, California introduced an online portal for residents to obtain a digital copy of their COVID-19 vaccine record. As California reopens more and more businesses may begin asking for proof of vaccination.   

Emory Roane, is a policy advocate for the Privacy Rights Clearinghouse. He’s concerned the state is leaving it up to residents to limit the use of their information.

"That … leaves the door wide open for businesses that are getting this information to maintain, retaining that information and then potentially use it, share it, sell it to third parties," Roane said.

CapRadio's Ed Fletcher spoke with Roane about their concerns about how that information is shared. 

Interview Highlights

What are your concerns as far as the electronic availability of vaccine information through California?

Our primary concern is around digitizing vaccine information and making it easy for that information to get into other people's hands. Unlike a paper card that you keep in your wallet and show to businesses, digital access is going to make it easier for businesses to retain that information afterwards. I think if you read the frequently asked questions page of the California Digital COVID-19 Vaccine Record website, it tells users you should ask the businesses that you're giving this information to what their policy is on sharing that information, which really puts a lot of the onus on the individual to read privacy policies to take these extra steps. 

What we would like to see are restrictions put in place of the program level that would prevent or at least require businesses to make assurances that they're not going to then resell that information or share that information with additional third parties. 

So is your fear not necessarily that the app that the government made will be shared, but that you'll then download another app that connects to that? Or whether it's a bar that has an app that makes it easy to show your verification that that company then sells your information to somebody else?

Specifically, if you look at the frequently asked questions under the heading, what happens to my information after I share it? It says, your digital COVID-19 vaccine record shows the same information as your paper CDC vaccine card. You can ask organizations that will scan the QR code in your digital COVID-19 vaccine record, how they will use your data or if they will keep it. And then it puts the onus on the individual saying only you can decide how and when to share your record. And so that obviously leaves the door wide open for businesses that are getting this information to maintain retaining that information and then potentially use it, share it, sell it to third parties.

But we would like to have seen are some restrictions in the actual underlying rollout of this program that would say, look, if you're a business and you're going to be receiving the vaccine information, that you need to make assurances beforehand that this is only going to be used for vaccine verification, for example, and that it's not going to be then sold or shared because unfortunately, all of this information is valuable.

Are you hoping to see the governor or the legislative branch address this issue? 

Unfortunately, it looks like this program is rolling out apace and there doesn't appear to be much to do about it at this point, an executive action certainly would be preferable to nothing. Ideally, legislation would have made it very clear before this program was rolled out that these guardrails needed to be in place. 

What, if anything, can consumers do? 

It's unfortunate that the onus is put on the individual to be affirmative and ask businesses what they're going to be doing with that information beforehand. You can always keep your paper record. You can also use this service to print off a copy of your paper record if you lose your paper card. But unfortunately, yes, folks should be prepared if they're concerned about this, to be asking businesses frequently, are you going to be retaining this information? Are you going to be selling this information or sharing it with anyone else? And if not, by the way, here's my paper card.