Last amended: 28 October 2021, app version 1.12
This privacy notice explains how your data is processed and what data protection rights you have when you use the CovPassCheck app to verify digital COVID Certificates.
Digital COVID Certificates have been valid within the entire European Union (EU) since 1 July 2021 as certification of COVID-19 vaccination and testing, and of recovery from a confirmed case of COVID-19. The official name is “EU Digital COVID Certificate” (certificate).
This privacy notice covers the following topics:
This app is published by the Robert Koch Institute (RKI) for the German Federal Government. The RKI is also responsible for ensuring that your personal data is processed in compliance with data protection regulations.
Using the app is voluntary. It is entirely up to you whether you install and use the app to verify the validity of certificates. There are other acceptable ways to check vaccination, test, or recovery certificates.
The app allows you to verify whether other people’s certificates are valid.
To do this, you can use the CovPassCheck app to scan the QR code displayed on a certificate presented to you, in order to ascertain whether that certificate is valid. The QR code contains an electronic signature of the national issuer (in Germany, the issuer is the RKI). The electronic signature is generated by the RKI when creating the certificate, on the basis of the data about the certificate holder which is contained in the certificate. The signature is a special type of encryption that allows the RKI to confirm that the certificate is an official digital document created by the RKI.
The RKI also provides the corresponding public keys from the RKI. These public keys can be used to check whether a certificate’s electronic signature actually originates from the RKI and whether the certificate has been manipulated since being signed electronically.
The CovPassCheck app regularly downloads the RKI’s public keys in the background and stores them locally on your smartphone. This allows the app to regularly check the validity of the electronic signature and thus the authenticity of the stored certificates. The public keys do not contain any personal data.
In order to be able to detect date manipulations in certificates, the date and time set in the smartphone is compared with the real-time information of a freely available time server.
EU countries may now adopt their own rules for the validity of certificates. For example, test certificates may be valid for a longer period in some EU countries than in others. The EU countries exchange these rules via a common exchange server. The CovPassCheck app regularly downloads the latest rules of all Member States from the app’s server system.
The verification takes place exclusively offline in the app and no data is passed on here to the RKI or other recipients (other health authorities in Germany or other countries and other third parties).
Please note that you are only authorised to have someone else present their certificate for verification to the extent permitted by law.
If you scan a certificate and read data in the process, you are responsible for compliance with data protection regulations.
In order to download the public keys for authenticating the electronic signature and the current rules on the validity of certificates, a connection regularly needs to be established to an RKI server. The server has to process technical access data for this purpose. This data includes the following:
This access data is processed to enable and secure the connection and data exchange between the app and the server. You will not be identified personally as a user of the CovPassCheck app and no user profile will be created. Your IP address will not be stored beyond the end of the individual usage procedure.
Access data is also processed to compare the date and time with the time server.
The RKI will only process your data if it has a legal basis for doing so. The processing of your access data as described in this privacy notice is necessary to technically implement the confirmation of the validity of the certificates. The legal basis for the processing of your access data is Sect. 3 of the German Federal Data Protection Act (BDSG) and Art. 6(1) Sentence 1(e) of the General Data Protection Regulation (GDPR).
The CovPassCheck app requires access to your smartphone camera when you scan the QR code to add a certificate in the app. The app also requires an internet connection in order to download the latest key information from the RKI server system. For information about other permissions the app may request, please refer to the FAQ section in the app.
The app will not permanently store the QR codes scanned by you, or the information read from them, on your smartphone. Nor will the RKI permanently store any personal data on the app’s server system.
The RKI has commissioned the company KDO Service GmbH (KDO) to operate and maintain the server system. KDO processes the personal data on behalf and at the instruction of the RKI (meaning it is what’s known as a processor under data protection law). Contractual safeguards are in place to ensure that the data protection requirements are met.
To ensure the correct time setting, the current time is obtained from a freely available, randomly selected time server from the NTP Pool project (region de.pool.ntp.org). Here access data is temporarily processed.
If the RKI processes your personal data, you have the following data protection rights:
Please note that the RKI can only fulfil the rights mentioned above if data to which the asserted claims relate is processed on an ongoing basis. This would only be possible if personal data were stored after being transmitted to the RKI server. This is not necessary for the purposes of the app. For this reason, the aforementioned data protection rights under Art. 15, 16, 17, 18 and 21 GDPR are largely redundant.
If you have any questions or concerns regarding data protection in connection with the CovPassCheck app, you are welcome to send them to the RKI’s official data protection officer by post to: Robert Koch-Institut, FAO the data protection officer, Nordufer 20, 13353 Berlin, or by emailing datenschutz@rki.de.