Online payments, self-service check-in, and attendee-printed name badges—these are just a few things that make attending a conference more convenient. They are especially valuable during a pandemic, as they enable contactless processes and signal a commitment to safer, in-person events with significantly reduced infection risks.
Shouldn't a similar approach be possible for vaccination records? We have been receiving this question very frequently lately.
Our answer is summarized in this video. For those who prefer to read or are unable to watch, the text version follows below:
Organizers primarily want a simple way to record vaccination status for their conferences. They are thinking of an additional option during registration where attendees can indicate their vaccination status in advance. A field could even be added to select the vaccine from a list. Alternatively, could vaccination records perhaps be uploaded?
That is true—at least in the sense that, from a technical standpoint, it is not rocket science to make this a standard part of online registration. Legally, however, the matter becomes much more complex. This is not just about personal data that can be collected, stored, and processed alongside other contact information under a contract.
Verify vaccination status, but do not store it
Under Article 9 of the GDPR, vaccination data is classified as health data and requires special protection. Private providers are not permitted to collect or process such health data without a specific legal basis. This applies even if the software is otherwise fully compliant with data protection regulations and ensures that all personal data is stored securely and is inaccessible to unauthorized parties.
At this time, no such law exists that would allow for an exception, as the Bremen Data Protection Commissioner clarified in a press release earlier this year.
Even contracts between organizers and software providers cannot bypass current regulations, and explicit consent from attendees does not count either. From a legal perspective, this is not a voluntary disclosure. If a person wants to attend, they must provide proof of vaccination. However, organizers are strictly prohibited from storing this information.
Our recommendation for conferences is as follows:
Check the documents during on-site check-in and have attendees present them to you. For each person, you can make a note confirming that the proof has been verified. A simple "yes" or "no" entry is sufficient. Keep in mind that you are not allowed to record details about the proof or the vaccination itself if you log and store that information anywhere, which is why you should be as data-minimalist as possible.
To prevent attendees from being denied entry because they forgot their proof, remind them during registration that it must be presented at check-in. Send a follow-up email to registered participants shortly before the conference begins as a final reminder.
How do you handle this at your conferences? Do you have any other tips that might help organizers? Feel free to share them with us.
