How are they any more illegal than normal passports, which contain personal data, or visas which have biometric data such as fingerprints attached to them? That data is shared all over the world when you apply for a visa, book flights or travel.

Also, if they are voluntary, but you cannot travel without one, then if you agree to have one you agree to the terms upon which it is issued to you, which would no doubt include the right for the data held to be transferred to national and international agencies "for the protection and/or prevention of xyz" such as immigration and national security departments, police, health services possibly even insurers.

Perfectly legal.
Vaccination requirements have been in force in many countries for decades.
Lots of countries wont let you in if you come from somewhere which has certain endemic diseases unless you can prove vaccination.

*Internally* is a different matter. There could well be discrimination arguments against it.

I'm a lawyer. The short answer is that it doesn't really matter.

It's probably not legal right now, but all it takes is Boris to call Parliament into session and scare them with some statistics about the virus for them to pass a law that will make it legal.

Having said that, as a practical matter, I don't expect them to go that far. They won't want the political hit and public outcry that will come from doing it openly. If they are really going to do it it will be more likely to be in an informal way (businesses and shops will start asking for it as a condition of entry, etc).

I can't see many businesses being capable of checking.

Supermarkets? On entry? Security guard doing it or an electronic gate?

Minimum wage bar staff in pubs (on the flimsy assumption they will ever be allowed to reopen properly again - I don't think they will)?

Etc

Of course the real pressure down the line may come via (not necessarily instigated by) businesses' indemnity insurers. I can see that being used as a back-door means to coerce business and therefore the public.