Coronavirus (COVID-19) domestic vaccine certification: business and regulatory impact assessment

Consumer Assessment

• Does the policy affect the quality, availability or price of any goods or services in a market?

No. The quality of goods and services available to consumers is unlikely to be impacted by the introduction of these regulations. However, the nature of services in different sectors will change as certification or provision of negative test results is mandatory in some settings and not others.

• Does the policy affect the essential services market, such as energy or water?

No. There is no expected impact on markets for essential services.

• Does the policy involve storage or increased use of consumer data?

Yes. When the original certification scheme was introduced on 1 October there was an interim solution which included increased use of consumer data. On 30 September we launched the NHS Scotland Covid Status App (the "App") for international use. This contained two unique QR codes, one for each dose of the vaccine. This product had been designed for use for international travel and so it is necessary to include full name, date of birth and details of vaccination to meet EU standards. This version of the App was used to demonstrate vaccine status in the settings in scope.

On 20 October, the NHS Scotland Covid Check App, which is used by venues to check QR codes, was updated so that when an international QR code is scanned for domestic purposes only, a green tick or 'certificate not valid' representing someone's vaccination status is displayed, rather than a person's name, date of birth and vaccination details.

In order to further minimise data display, on 21 October, the Covid Status App was updated to include a domestic page. This option simply shows the person's name and a QR code. When the QR code is scanned by the NHS Scotland Covid Check App it shows either a green tick or 'certificate is not valid' representing someone's vaccination status. The domestic App has functionality to hide or display a person's name. The Privacy Notice can be found on NHS Inform: Personal information we process, How we use your data, Your Rights.

Demonstration of a negative LFD or PCR result as reported to the public reporting system will be through the presentation of a text message or email.

An update to the NHS Scotland Covid App will allow the added function to register and present record of a negative PCR test in December, with the inclusion of LFD tests to follow in a further iteration

Similarly, if someone is exempt, the interim solution (an exemption certificate) will state that fact and can be seen by the verifier. It is important to note that the personal data of individuals whose vaccination status is being verified is never stored or transmitted by the NHS Scotland COVID Check App. Once verification is complete, the personal data is deleted.

• Does the policy increase opportunities for unscrupulous suppliers to target consumers?

Unclear. There is a possibility that businesses that are outwith the settings outlined by the policy will adopt Certification. There is also a possibility that even those businesses that are in scope will adopt it for a definition of 'consumer' broader than what is intended (i.e. more than just attendees, for example performers or staff).

The Regulations will mitigate these risks to an extent, as they will clearly define the settings where there will be a legal requirement for businesses to take all reasonable measures to check vaccination, testing and exemption status. Equally, the Regulations will be clear that that legal requirement will not apply to employees or any person other than the attendees or 'consumers' of the service.

The risks will be further mitigated with sectoral guidance. To support effective implementation consistent with our policy aims, we will provide more information to the sectors where an amendment of Certification is mandated about the appropriate implementation, enforcement and handling of exemptions.

Ministers have been clear that Certification will not be a requirement for public services or other settings that many people have no option but to attend such as retail, public transport, health services and education. We recognise that some businesses, outside the settings in scope, are asking people for evidence they have been fully vaccinated as a condition of entry or as a condition of employment. Businesses which are not covered by the Government's scheme are required to meet their obligations under all relevant law including data protection, the Equality Act and Human rights in their design and implementation of any such policy. For more information see the Equality and Human Rights Commission Guidance for Employers here.

• Does the policy impact the information available to consumers on either goods or services, or their rights in relation to these?

Yes. Consumers (i.e. attendees of the venues and events in scope) will have information about their rights regarding their personal data. A Privacy Notice has been produced and can be found on NHS Inform. We are also developing Data Protection Impact Assessment (DPIA) which will be accessible to the public and kept up to date.

The Scottish Government is undertaking significant media relations and social media activity through Scottish Government accounts to increase awareness among the public of Certification. This is being supported by paid for advertising activity during September and October that will reach 3.32 million adults through radio and digital advertising. Also, information on domestic certification is being added to nhsinform.scot. Promotional materials are being distributed to key stakeholders to be used by those businesses and locations where Certification will be required.

• Does the policy affect routes for consumers to seek advice or raise complaints on consumer issues?

No - There is no expected impact on the routes for consumers to seek advice or raise complaints on consumer issues.