Biometrics and user control, maybe a piece of paper; Gruener and Cavoukian on Good Health Passes

The Good Health Pass initiative is ID2020’s most ambitious project yet. In a sense, it could be considered a culmination of the organization’s work so far, as its original mandate to maximize the potential of digital ID to improve lives dovetailing with the urgent need for credentials which provide trustworthy proof of an individual’s test or vaccination status without trampling on the rights of those individuals.

Biometrics are an aspect of both ID2020’s overall goal, and the Good Health Pass initiative, and Ann Cavoukian, executive director of the Global Privacy & Security by Design Centre, told Biometric Update in an interview that biometric technology seems likely to be a necessary component of Good Health Passes to bind the credential to the individual.

Most of the leading health pass solutions on the market have signed on, but ID2020 Executive Director Dakota Gruener tells Biometric Update that to be relevant, the initiative’s recommendations must be decided on and issued by the end of May. Therefore, she says, “The real challenge is what comes next.”

Cavoukian makes clear that she is not, in fact, in support of the use of digital health passes in general, but says that having acknowledged that they will be used, it is imperative that they maintain user control as much as possible, to mitigate myriad potential privacy and data security harms.

“That preserves total control, and privacy to me is all about control; personal control over the use and disclosure of our information,” Cavoukian explains. “So as much as I don’t like the idea of these passes, the reality is we have to have them, so let’s create them to be as privacy-protected as possible and under the personal control of the individual to whom the information relates. And that’s what we’re doing with the good health pass.”

“Overwhelming interest”

The initiative includes participants from all relevant sectors, but the digital identity industry has been particularly responsive.

“One thing I was particularly enthusiastic to see is that a huge number of health pass solutions have signed up, and that is significant when we’re talking about standards for interoperability,” Gruener says. “If each of the organizations who need to develop solutions interoperable with one another are saying ‘we get it and we want to develop solutions that are interoperable,’ then that goes a long way right off the bat to ultimately having individual consumers have health passes that work for them.”

The Good Health Pass initiative published its white paper with 25 endorsing organizations, and since then Gruener says there has been “truly overwhelming interest,” with another 200 reaching out. In that time, Yoti has joined biometrics providers including Clear, Daon, iProov, SITA, Vision-Box and Evernym as part of the Collaborative.

The expectation is that both guidance on interoperability standards and a trust framework will be complete by the end of May. That means health and travel sector representatives, identity solutions providers, standards agencies and other stakeholders will have to not only come on board, but agree on both issues.

Industries that have not traditionally worked well together, therefore, must come together over the next three months to carry out a standards-building process similar to ones that have gone on for years.

While participation from the identity space strong, as someone with a background in global health, Gruener (who has worked in private sector engagement with Gavi for seven years) says she is sensitive to what happens with a group of tech folks in a room “in a bit of a vacuum. That is not what Good Health Pass will be satisfied with.”

It is health stakeholders, but healthcare providers and public health authorities, that ID2020 is seeking greater participation from. One of the areas in which guidance is needed is how tests should be proved, and what information provided as part of that proof. The World Health Organization Smart Vaccination Certificate Working Group is addressing the details for vaccination, but Gruener notes there is no equivalent for tests.

For those biometrics and digital identity solution providers who do sign on, certification means assurance that the application follows Privacy by Default and Design principles, due to Cavoukian’s involvement. That endorsement carries significant weight, she points out.

“Companies who have gotten certified for privacy by design have told me it builds trust like no other,” Cavoukian says. “Trust in business relationships where it has not existed before. So with the good health pass, for example, we want privacy as the default, embedded by design into these operations so people don’t have to worry.”

What’s next?

The Collaborative urged the White House this week to establish official guidance on the development and deployment of health passes, in a letter addressed to White House Coronavirus Coordinator Jeff Zients. On behalf of the more than 80 signatory organizations behind the Collaborative, the letter offers to support the administration in the matter, and asks it to endorse the Good Health Pass principles and incorporate them into policy and direction.

The letter also suggests convening a high-level roundtable with representatives from select federal government departments and private sector representatives, and the issuance of preliminary guidance on appropriate use cases for health passes. The Collaborative also asks that the White House Health Equity Task Force, led by Dr. Marcella Nunez-Smith, to inform its guidelines and policies.

To craft its interoperability standards and trust framework, Gruener says the initiative wants to create an open and inclusive approach while being agile. To that end, it has developed an outline for companies that want to contribute, and plans to use a “divide and conquer approach” to drafting recommendations and getting opinions down on paper.

Each group will contribute to only one area, but any Good Health Pass contributor can review and comment on any section, Gruener explains. A public comment period is also planned for May 1 to 15.

Asked about on-device compared to cloud biometrics capabilities in Good Health Passes, Cavoukian acknowledges it as an area of concern, but says that it is the security team’s role to make sure that wherever it is stored, data is stored properly and access secured appropriately.

Crisis and opportunity

Cavoukian agrees that this could be a breakthrough moment for self-sovereign identity (SSI) and decentralized models, with the first truly reusable and portable digital identity many people have ever received giving them greater control than they have ever had over their personal data.

While inclusivity is often a concern for smartphone-based digital identity credentials, Gruener says a lot of work has already been done on that problem.

“What’s interesting is that there’s a huge body of work on paper-based verifiable credentials,” she observes. “So, it’s actually an incredibly low-tech approach that has the benefits in terms of ease-of-use and use wherever of paper, but built-in is greater protection for privacy, and the ability to verify that the credential has not been forged.”

These documents could include a QR code, which when scanned provides just enough information to the verifier to carry out an additional step, such as a biometric authentication proving that the person presenting the credential is the one who received the negative test result of vaccination.

The opportunity for better paper-based credentials is mirrored in an opportunity to change the expectations for digital credentials, so that members of the public, who Cavoukian says have made clear their desire for greater privacy protection, can actually have it. A design that is easy to use and protects privacy by default is the key to delivering on that promise, and a stark contrast from the protections available to people today.

“It’s not simple; it’s laborious!” Cavoukian declares. “Most methods available to individuals to protect their privacy are a big deal. It’s not an easy kind of, ‘hit this button and we’re good.’ It’s been the exact opposite, there are all these steps you have to go through, people have to read stuff, nobody does that. But that doesn’t mean they’re not concerned.”

Cavoukian is also generally interested in the potential of biometric encryption to enhance security and privacy together.

It is also possible, Gruener points out, that the adoption of digital health passes will turn out to be entirely driven by a certain set of vertical use cases, such as for business travelers. That could alleviate many of the concerns currently in play, and as Gruner says, may not be a bad thing.

Article Topics

biometrics  |  credentials  |  data protection  |  digital identity  |  Dr. Ann Cavoukian  |  Good Health Pass Collaborative  |  ID2020  |  identity verification  |  interoperability  |  privacy  |  Privacy by Design  |  standards  |  verifiable credentials