Last amended: 31 January 2022, app version 1.17
This privacy notice explains how your data is processed and what data protection rights you have when using the CovPass app to manage certain certificates – digital COVID Certificates proving coronavirus vaccinations, negative coronavirus test results, or that you have recovered from a confirmed case of coronavirus.
Please also note the data protection information that you receive when your digital COVID Certificate is issued (e.g. at a vaccination/testing centre, doctor’s surgery or pharmacy).
This privacy notice covers the following topics:
Do you have any questions about the CovPass-App? Answers to many common questions can be found on the RKI’s official CovPass website (www.digitaler-impfnachweis-app.de/faq).
This app is published by the Robert Koch Institute (RKI) for the German Federal Government. The RKI is also responsible for ensuring that your personal data is processed in compliance with data protection regulations.
The digital COVID Certificate is proof that a person has
Digital COVID Certificates have been valid within the entire European Union (EU) since 1 July 2021 as certification of COVID-19 vaccination and testing, and of recovery from a confirmed case of COVID-19. The official name is “EU Digital COVID Certificate” (certificate).
A certificate can be obtained on request from a competent entity (vaccination centres, testing points, doctor’s surgeries or pharmacies) after a vaccination, a test or after recovering from a confirmed case of COVID-19.
You can carry the certificate in paper form or in electronic form on your smartphone. Each certificate contains a QR code with an electronic signature from the RKI to protect against forgeries. If you would like to store a certificate on your smartphone, you can simply scan the QR code with the CovPass app. The app then securely stores an electronic version of the certificate on your smartphone.
More information about how the certificate works is available on the following websites:
Please note that the QR codes on the certificates contain health data (data about coronavirus vaccinations, coronavirus test results or your recovery from a confirmed case of coronavirus). You should only show the certificates and QR codes if you want to provide appropriate proof. Do not provide QR codes to anyone if you do not want the data to be read. To prevent unwanted access to the certificates stored on your smartphone, you should set up a code lock on the device.
Yes, using the app is voluntary. Each certificate can also be used in paper form as proof of vaccination, a test result or recovery. You will not suffer any disadvantages, because the paper version and the electronic version of the certificate are equivalent. You can decide at any time whether you want to scan the QR code and store the certificate in the app. You can also delete the certificate from the app at any time.
The RKI briefly processes the necessary personal data of certificate holders to technically create and sign the requested certificate (Sect. 22(5)–(7) of the Infection Protection Act, IfSG). The personal data is deleted at the RKI immediately once the technical creation of the certificate is complete. There is no centrally administered registry of vaccinations or certificates.
You can use the CovPass app to scan your own printed certificates and those of family members and store them in encrypted form on your smartphone.
In order to prove to third parties – in the situations where this is required by law – that you have been vaccinated, have tested negative, or have recovered from COVID-19, you can show the relevant certificate to the person performing the check. If the person performing the check uses a special verification app (such as the RKI’s CovPassCheck app), it is sufficient to show the QR code of the certificate and have it scanned. The QR code is the certificate in digital form and contains only the information necessary for the specific type of certificate (see Section 5).
The verification app allows for example authorities, travel companies and other service providers in the EU to scan the QR code of the certificate presented to them, in order to check its validity. During the verification, the data contained in the certificate is read. For the certificate to be valid, it must meet the following technical and formal criteria:
The verification app will show whether the certificate provided is valid. If the certificate is valid, the name and date of birth of the certificate holder will also be disclosed, as will whether or not it is a test certificate. In the case of test certificates, the time of sampling will also be displayed.
The name and date of birth of the certificate holder are displayed so that the person performing the check can compare this information with an ID document (e.g. passport or ID card). A notification of whether the certificate is a test certificate, and the time of sampling, are necessary to enable the person performing the check to assess whether the test result on which the certificate is based is still valid.
To protect against forged certificates, it is necessary to verify the authenticity of the stored certificates. The electronic signature contained in a certificate’s QR code is used for this purpose. The electronic signature is generated by the RKI when creating the certificate, on the basis of the data contained in the certificate (see Section 5). The signature is a special type of encryption that allows the RKI to confirm that the certificate is an official digital document created by the RKI.
The RKI also provides the corresponding public keys from the RKI. These public keys can be used to check whether a certificate’s electronic signature actually originates from the RKI and whether the certificate has been manipulated since being signed electronically.
To protect the health of certificate holders and the public, certain certificates may be revoked in special cases. This may be necessary, for example, if a competent entity (e.g. pharmacy, vaccination centre or doctor’s surgery) has issued incorrect or fraudulent certificates. Revocation will result in the certificate becoming invalid and no longer being accepted when verified. It does not matter whether the certificate is presented in electronic form on a smartphone or on paper during the verification. If you have stored a revoked certificate in the app, it will show as “invalid”.
To be able to determine the validity of the electronic signature or whether stored certificates have been revoked, the app regularly downloads the RKI’s current public keys and revocation lists in the background and stores them locally on your smartphone. This allows the app to regularly check the electronic signature and thus the authenticity as well as the revocation status of the stored certificates. The public keys and revocation lists do not contain any personal data. The revocation lists only contain a small subsection from the unique certificate identifier of the revoked certificates. This subsection is identical for all certificates issued by the same competent entity (e.g. a pharmacy). The CovPass app then compares this with the unique certificate identifier of the certificates stored on the smartphone. If there is a match, the certificate in question will be shown as invalid in the CovPass app. However, the revoked certificate itself is not changed. Both the verification of the electronic signature and the comparison with the revocation lists take place exclusively offline in the app and no data about this process is passed on to the RKI.
You can use the “Check validity” feature to check for yourself whether the certificates stored in the app meet the official formal requirements of a particular EU country. EU countries may adopt their own rules for the validity of certificates. For example, test certificates may be valid for a longer period in some EU countries than in others. The EU countries exchange these rules via a common exchange server. Before starting a trip, you can therefore use the app to check whether your certificates are valid in the destination country.
If you want to check whether a certificate is valid, your app downloads the current rules of all Member States from the app’s server system. The app then uses the data contained in a certificate to check whether that certificate complies with the rules before showing you the corresponding result. The verification takes place exclusively offline in the app and no data is passed on here to the RKI or other recipients (other health authorities in Germany or other countries and other third parties).
Please note that entry rules are subject to change and additional rules may apply both in the destination country and when you return. Guidance on entry requirements can also be found on this EU website: https://reopen.europa.eu/en
The app can remind you to check stored vaccination certificates if you received your last vaccination a long time ago. To do this, the app downloads the current rules on booster vaccination recommendations from the app’s server system at regular intervals. The app then uses the data contained in the certificates to check whether a booster vaccination is recommended soon. This check also takes place exclusively offline in the app and no data about the vaccination is passed on to the RKI.
You have the option of exporting a certificate stored in the CovPass app, in order to print it out and use the paper version (e.g. when travelling for extended periods) or scan the certificate afterwards with a new smartphone and store it again as an electronic version in the CovPass app (e.g. if you get a new smartphone). The “Create EU printout” feature uses the data of the certificate stored in the CovPass app in order to create a PDF file. This processing is performed only locally on your smartphone. You then have the option of storing this PDF file. Creating an EU printout is voluntary. The PDF document contains sensitive health data (data about coronavirus vaccinations, test results or recovery from confirmed cases of coronavirus). Therefore, please keep the stored or printed certificate safe and do not publish or share the document. The EU printout feature only works for certificates issued in Germany by the RKI.
When you book a ticket with a travel or event company or other provider, you can use the app to submit a digital COVID certificate to the provider’s verification partner so that it can verify the validity of the certificate for your booking with the travel or event company.
To do this, you will need to have added a digital COVID certificate in the CovPass app. The app will ask the provider for the booking information to be used for verification and suggest a suitable certificate based on this information. You can then select this and send it to the verification partner together with the booking information made available by the provider (See Section 5 c.).
The verification partner will check whether the certificate’s electronic signature is genuine and that the technical expiration date has not passed. The verification partner will immediately inform the provider of the result of this verification. The only information communicated will be whether the verification was successful or not. You will also be shown the result of the verification in the CovPass app.
The booking information made available by the provider is only processed locally in the CovPass app. This means the RKI cannot tell which certificates you have selected and had verified or which trips or events you have booked.
The RKI is not responsible for the data processing performed by the provider and the verification partner. Please read their privacy notices so that you know what your data is used for and how it is used.
The certificates contain health data and are stored in a secure area on your smartphone. The certificates contain the following data:
You can find out what specific information is stored in a certificate from the information provided on the certificate (in German and English). No information other than that indicated on the certificate is stored.
This data will be stored in the app as soon as you scan the QR code on the printed certificate. This data was collected previously by the entity that issued the certificate, and transmitted to the RKI so that the certificate could be signed.
In order to download the RKI’s public key for authenticating the electronic signature, the revocation lists and current rules of the Member States on the validity of certificates, and the rules on booster vaccination recommendations, a connection needs to be established to an RKI server. The server has to process technical access data for this purpose. This data includes the following:
This access data is processed to enable and secure the connection and data exchange between the app and the server. You will not be identified personally as a user of the app and no user profile will be created. Your IP address will not be stored beyond the end of the individual usage procedure.
If you make a booking via the internet with a travel or event company or other provider, you can use the CovPass app to prove to the provider that you have a valid digital COVID certificate (verification of certificates for ticket bookings). To do this, you will need to have added a digital COVID certificate in the CovPass app. In addition, the provider must be connected to a verification service.
To check the certificate, you will require a special QR code which you will receive from the provider as part of the booking process. This QR code contains a unique transaction ID, a short description of the booking (e.g. “booking number 1234”) and an internet address (URL).
The CovPass app uses this information to retrieve technical specifications from the provider as well as the following booking information for consideration when verifying the COVID certificate:
The provider decides which specific information will be used to verify the COVID certificate, and which COVID certificates are permitted as proof.
The RKI processes the certificate data mentioned above in Section 5 a. for the purpose of technically creating and signing the requested certificate. The legal basis for the processing in each case is Art. 6(1) Sentence 1(c), Art. 9(2)(g) of the General Data Protection Regulation (GDPR) in conjunction with
According to Sect. 22(5)–(7) IfSG, the RKI is obliged to technically create and sign the requested certificate, provided that the vaccinated, recovered or tested person requests the issuance of such a certificate.
Since 1 July 2021, there has also been a basis under European law for this processing. In this respect, the legal basis is Art. 6(1) Sentence 1(c), Art. 9(2)(g) GDPR in conjunction with Art. 10(2) of Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic).
The processing of data in connection with the feature for verifying COVID certificates for ticket bookings is based on your consent. The legal basis is Art. 6 (1) lit. a, Art. 9 (2) lit. a DSGVO.
The legal basis for the processing of the access data mentioned above in Section 5 b. is Sect. 3 of the German Federal Data Protection Act (BDSG) and Art. 6(1) Sentence 1(e) GDPR.
The CovPass app requires access to your smartphone camera when you scan the QR code to add a certificate in the app. The app also requires an internet connection in order to download the latest key information from the RKI server system. For information about other permissions the app may request, please refer to the FAQ section in the app.
The certificates will only be stored in the app on your smartphone. The certificates are not automatically deleted in your app. If you wish to delete a certificate, you can remove a certificate from the app yourself at any time or delete the app. To add the certificate again later, you will need to rescan the QR code of the printed certificate.
The booking information required for the verification of certificates for ticket bookings will be deleted after the verification.
The RKI does not permanently store any personal data relating to the certificates on the server system. Immediately after the signed certificate has been provided to the issuing entity, the data is permanently deleted at the RKI.
The RKI has commissioned the company KDO Service GmbH (KDO) to operate and maintain the server system. KDO processes the personal data on behalf and at the instruction of the RKI (meaning it is what’s known as a processor under data protection law). Contractual safeguards are in place to ensure that the data protection requirements are met.
If, in the situations where it is required by law, you present a certificate to other persons or entities (for example, European border authorities or service providers), they will become aware of all the data contained in the certificate.
You can prevent this by showing the QR code in the app, so that it can be scanned using a verification app. Then, the data contained in the QR code will be read. Here the verification app will only show whether the certificate shown is valid, together with an explanation of the result. In the case of a valid certificate, the name and date of birth of the certificate holder are displayed additionally in the verification app, so that the person performing the check can compare this information with an ID document (e.g. passport or ID card). In addition, it is displayed whether the certificate is a test certificate or not. In the case of test certificates, the time of sampling is then also displayed so that the person performing the check can assess whether the underlying test result is still valid.
The verification app will only process the displayed data for a short time. Once the verification is complete, the displayed data is discarded, meaning the data that has been read is not permanently stored.
During certificate verification for ticket bookings, your COVID certificates and booking information are transmitted to a verification partner used by the provider. The specific verification partner is displayed in the CovPass app before transmitting the information. To retrieve the individual booking information, the CovPass app transmits to the provider the booking identifier contained in the provider’s booking QR code.
If the RKI processes your personal data, you have the following data protection rights:
Please note that the RKI can only fulfil the rights mentioned above if data to which the asserted claims relate is processed on an ongoing basis. This would only be possible if personal data were stored after being transmitted to the RKI server. This is not necessary for the purposes of the app. For this reason, the aforementioned data protection rights under Art. 15, 16, 17, 18 and 21 GDPR are largely redundant.
If you have any questions or concerns regarding data protection in connection with the CovPass app, you are welcome to send them to the RKI’s official data protection officer by post to: Robert Koch-Institut, FAO the data protection officer, Nordufer 20, 13353 Berlin, or by emailing datenschutz@rki.de.