The European Union’s response to the COVID-19 pandemic relied heavily on creating, deploying and using digital technologies. This article focuses on the implications of two such measures - digital contact tracing and digital vaccine certificates. Much of the academic response to these has focused on data protection law, the preservation of privacy and the reluctance to build surveillance infrastructures that would empower states with tracking capabilities. This contribution tackles these digital initiatives from another angle. It examines their deployment through a broader human rights lens, and explores whether the EU, in mobilising these measures to curb the pandemic and reinstate free movement during these times, complied with its international obligations to protect human rights, particularly those enshrined in the European Convention on Human Rights and the EU Charter of Fundamental Rights. This paper argues that in urgent and extraordinary contexts where knowledge and understanding of health threats are limited, such as was the COVID-19 pandemic, it remains essential to be prudent if and when overstating the primacy of one or more rights over others. Human rights instruments include provisions on emergency contexts, and laws implementing fundamental rights, such as the GDPR, allow for the deployment of measures to help protect against threats to public health. It is essential in such contexts to strive for an appropriate balance which ensures a sustained role for protective mechanisms such as lawfulness, proportionality, and legal and technical safeguards, in light of public interest goals and without undue deference to state interests which may have serious implications - such as, in this case, unjustified mass surveillance.