Coronavirus (COVID-19) domestic vaccine certification: business and regulatory impact assessment

Consumer Assessment

• Does the policy affect the quality, availability or price of any goods or services in a market?

No. The quality of goods and services available to consumers is unlikely to be impacted by the introduction of these regulations. However, the nature of services in different sectors will change as Certification is mandatory in some settings and not others.

• Does the policy affect the essential services market, such as energy or water?

No. There is no expected impact on markets for essential services.

• Does the policy involve storage or increased use of consumer data?

Yes. The interim solution does includes increased use of consumer data. The QR codes available at launch will contain the first name, surname, date of birth and vaccination information for each dose, as described in the EU Specification. This information will be displayed to the verifier of a QR code at a venue or event once they scan it with the NHS Scotland COVID Check App. Similarly, if someone is exempt, the interim solution (an exemption certificate) will state that fact and can be seen by the verifier. However, once the NHS Scotland Covid App has been upgraded to include a domestic mode, the QR codes in the domestic mode will present minimal personal information of the consumer, simply relaying eligibility. It is important to note that the personal data of individuals whose vaccination status is being verified is never stored or transmitted by the NHS Scotland COVID Check App. Once verification is complete, the personal data is deleted.

• Does the policy increase opportunities for unscrupulous suppliers to target consumers?

Unclear. There is a risk that businesses that are outwith the settings outlined by the policy will adopt Certification. There is also a risk that even those businesses that are in scope will adopt it for a definition of 'consumer' broader than what is intended (i.e. more than just attendees, for example performers or staff).

The Regulations will mitigate these risks to an extent, as they will clearly define the settings where there will be a legal requirement for businesses to take all reasonable measures to check vaccination status. Equally, the Regulations will be clear that that legal requirement will not apply to employees or any person other than the attendees or 'consumers' of the service.

The risks will be further mitigated with sectoral guidance. To support effective implementation consistent with our policy aims, we will provide more information to the sectors where Certification is mandated about the appropriate implementation, enforcement and handling of exemptions.

Ministers have been clear that Certification will not be a requirement for public services or other settings that many people have no option but to attend such as retail, public transport, health services and education. We recognise that some businesses, outside the settings in scope, are asking people for evidence they have been fully vaccinated as a condition of entry or as a condition of employment. Businesses which are not covered by the Government's scheme are required to meet their obligations under all relevant law including data protection, the Equality Act and Human rights in their design and implementation of any such policy. For more information see the Equality and Human Rights Commission Guidance for Employers.

• Does the policy impact the information available to consumers on either goods or services, or their rights in relation to these?

Yes. Consumers (i.e. attendees of the venues and events in scope) will have information about their rights regarding their personal data. A Privacy Notice has been produced and can be found on NHS Inform. We are also developing Data Protection Impact Assessment (DPIA) which will be accessible to the public and kept up to date.

The Scottish Government is undertaking significant media relations and social media activity through Scottish Government accounts to increase awareness among the public of Certification. This is being supported by paid for advertising activity during September and October that will reach 3.32 million adults through radio and digital advertising. Also, information on domestic certification is being added to nhsinform.scot. Promotional materials are being distributed to key stakeholders to be used by those businesses and locations where Certification will be required.

• Does the policy affect routes for consumers to seek advice or raise complaints on consumer issues?

There is no expected impact on the routes for consumers to seek advice or raise complaints on consumer issues.