The issue is not about compression (well, it could be).
It is is about the authority that delivers the QR code: if it doesn't have the data (photo) it can't produce the QR code.
For example, I have been vaccinated in April, long before the green pass appeared. No one took my picture at that time (and that's not the task of doctors to take pictures and store them in central database, for privacy reasons). I still deserves a QR-code to go out of home.
In France we have ID cards which can link a photo to the name and birth date. So encoding name and birth date in the QR-code are enough.
It is is about the authority that delivers the QR code: if it doesn't have the data (photo) it can't produce the QR code.
For example, I have been vaccinated in April, long before the green pass appeared. No one took my picture at that time (and that's not the task of doctors to take pictures and store them in central database, for privacy reasons). I still deserves a QR-code to go out of home.
In France we have ID cards which can link a photo to the name and birth date. So encoding name and birth date in the QR-code are enough.