DVI: information stored in QR codes of Covid-19 certificates is secure

The risk of the information scanned from QR codes of Covid-19 certificates being used again is zero, said the director of Latvian Data State Inspectorate (DVI) Jekaterina Macuka in an interview to TV3 programme 900 seconds.
DVI has received many questions from residents, asking if the requirement to present Covid-19 certificates is even legal. Residents are mostly worried if the information scanned from QR codes remains on the device that scanned them or is transferred elsewhere to be used later.
Macuka explains the requirement to show certificates or leave other personal information so that authorities can contact the person later is justified with the special situation under which such a requirement is implemented and regulations adopted to govern it.
«Two years ago no one would have done this because there was no need for it, but now Latvia is under a state of emergency. There are certain restrictions for when residents enter stores or come to receive services. This is why it is necessary to check every person’s certificate and personal ID. It’s the same as when you go buy alcohol,» says DVI manager.
Macuka said DVI recommends employers to check their employees’ certificates online, using Zoom platform, for example. This way there is no need to send the certificate over. However, if this is not possible, employers can ask employees send over certificates over e-mail. Nevertheless, the document should be accompanied with a password, so that anyone who could intercept an e-mail would not be able to access and use it. The recipient of the e-mail containing the certificate should also delete the e-mail after checking the certificate.
The manager of DVI stresses people should not be worried about the safety of the data stored in Covid-19 certificates. The reason is because the QR code does not contain the personal code, address or any other form of sensitive data. On top of that, information scanned from the certificate is deleted from the scanning device. «The security guard who scans QR codes can see the certificate for a second or two at the most. The risks of someone using scanning the QR code and then using information from it is zero,» said Macuka.