[intellirogue]

It is cryptographically signed, so creating your own QR code that would be accepted by the apps would be difficult without the signing key.

Even ignoring that though: including both the ID and detail allows it to work both ways. In official situations (e.g. at a country border) you might be able to validate against a server, but the local nightclub probably doesn't have access to a validation server.

[IshKebab]

You could just copy someone else's code though, unless they also check photo ID or something (seems unlikely for a pub).

[Dagonfly]

Yes. This is officially acknowledged (at least in the german CovPass app) and is a feature. You are able to "manage" multiple passes in said app. This is intended for accessibility (elderly partners with a shared smartphone, legal guardians for people with disabilities).

And yes, in theory at least the name should be crosschecked with a form of ID. It's just a digital copy of a legal document, you could easily borrow or copy the paper version from someone else as well.

[samuel]

You are right with regards to the technical side, but there is an important detail to note. Those certificates only can be used for travelling between eu states. Any other use is currently banned and would need to ammend the EU regulation.

So the local nightclub cann't(legally) check these certificates.

[mstolpm]

Are you sure? Isn't https://greencheck.gv.at/ a tool for private nightclubs, event managers, hospitality and so on to check the "grüner Pass" QR-Code certificate of their guests in Austria for accordance with their 3G rules (Genesen (recovered), Geimpft (vacinated), Getested (tested))? Am I missing something there?

[ajsnigrutin]

In slovenia, clubs/restaurants/etc. are not allowed to check any vaccination/test/recovered data (you still need to be one of those, they can ask if you are, but are not allowed to verify).

Only health inspectors can do so, and they do random checks. Honestly, I don't know how this will end, because people are really fed up with this situation and all the lies from the government, and a club full of drunk people vs a few inspectors won't end well.

[franga2000]

I'm from Slovenia as well and get asked to show my ID and vaccination slip regularly.

If I understand correctly, one of the pandemic laws requires them to verify, but the Information Commissioner's Office has countered that with one of their classic "well yes, but actually no" opinions saying that they're not actually allowed to demand that kind of information. What "demand" means here, of course, doesn't seem to be defined well, so I'm guessing they're still allowed to refuse service if you don't show them some proof.

Or maybe all of that has changed in the 20h since I was last at a bar - the speed at which the current government is making seemingly entirely random changes to the covid rules is genuinely impressive.

[samuel]

That's interesting, but I guess it needs some legal support at the Austrian level, because the regulation doesn't prescribe those uses for the certificate.

[the_mitsuhiko]

There is a law in Austria for this.

[_ZeD_]

Each state can create (and have created) additional restriction.

For example here in Italy I need the green pass to go to a wedding next week

[fabian2k]

I don't think that is true, at least not universally in all EU countries. And here in Germany they're allowed to check the old paper vaccination pass, so there is no reason to think they're not allowed to check the digital version.

[samuel]

As far I have been told by the national authorities of my country, that's the case. I haven't read the whole regulation but this paragraph I think it addresses it:

This Regulation establishes the legal ground for the processing of personal data within the meaning of point (c) of Article 6(1) and point (g) of Article 9(2) of Regulation (EU) 2016/679, necessary for the issuance and verification of the interoperable certificates provided for in this Regulation. It does not regulate the processing of personal data related to the documentation of a vaccination, a test or a recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records

Member States may process personal data for other purposes, if the legal basis for the processing of such data for other purposes, including the related retention periods, is provided for in national law, which must comply with Union data protection law and the principles of effectiveness, necessity and proportionality, and should contain provisions clearly identifying the scope and extent of the processing, the specific purpose involved, the categories of entity that can verify the certificate as well as the relevant safeguards to prevent discrimination and abuse, taking into account the risks to the rights and freedoms of data subjects

So, if my interpretation is right, a national law backing those "secondary" uses must be in place.

[the_mitsuhiko]

And it is in a few countries. Austria and Germany included.