As COVID-19 vaccines become more widely available to Canadians in all provinces, the public discourse in respect of immunization has begun to include talk of vaccine passports. Though vaccine passports could take many forms, including but not limited to a printed document or a digital certificate, their function would essentially be to facilitate a return to normal life while continuing to protect public health. In other words, vaccine passports would allow individuals to safely gather and access goods and services (e.g., restaurants, sporting events, airline travel, etc.) in exchange for disclosing personal health information about their immunization status. Although vaccine passports would quite clearly offer a significant public benefit in the midst of the ongoing pandemic, both from a public health and from an economic perspective, they also raise significant privacy concerns. In light of these concerns, the federal, provincial and territorial privacy commissioners, as well as the ombuds of Manitoba and New Brunswick, recently issued a joint statement providing helpful guidance on the issue.
In the joint statement, the privacy commissioners and ombuds indicate that despite their potential benefits, vaccine passports constitute an encroachment on Canadians’ civil liberties that should only be taken after thoughtful consideration. They further indicate that vaccine passports must therefore be developed and implemented in compliance with all applicable privacy laws and best practices to ensure the highest level of privacy protection in respect of the sensitive personal health information that would be collected or disclosed through such a measure.
The joint statement goes on to outline a number of fundamental privacy principles that should be adhered to in the development and implementation of vaccine passports. These include:
- Necessity, Effectiveness and Proportionality: Given the significant privacy risks involved, all organizations considering the use of vaccine passports must establish the necessity, effectiveness and proportionality of the measure in each specific context in which they will be used or required. In other words, vaccine passports must be necessary to achieve their intended public health purpose based on relevant evidence; they must be effective in meeting that purpose, not only at the time of implementation but also throughout their lifecycle; and finally, the privacy risks associated with vaccine passports must be proportionate to that purpose (i.e., the minimum necessary to achieve the stated purpose).
- Legal Authority: A public or private sector organization considering using vaccine passports must have the clear legal authority to do so. Depending on the specific jurisdiction and circumstances, that authority could flow from a new or existing statute or a public health order. In certain cases, voluntary and meaningful consent may suffice to provide the required legal authority, though there are a number of exceptions to this approach (e.g., for example, in the case of organizations subject to the Privacy Act, or subject to Québec’s Civil Code and privacy laws).
- Transparency: All organizations considering the use of vaccine passports must be sure to disclose to affected individuals the purpose and scope of the measure, as well as explain how any personal health information collected in respect thereof will be used, retained, disclosed and disposed of.
- Accountability: Any individual required to disclose personal health information in the form of a vaccine passport should be provided with information on how to access and correct such information, as well as on how to make an inquiry or complaint in relation to the use of the measure.
- Safeguards: Appropriate technical, physical and administrative safeguards must be implemented and regularly tested in order to ensure the protection of personal health information collected by or disclosed to an organization through the use of vaccine passports.
- Independent Oversight: All organizations considering the use of vaccine passports should consult with the privacy commissioners in their respective jurisdiction during the development of any relevant policy, agreement or law.
Finally, the privacy commissioners and ombuds recommend that that any personal health information collected or disclosed through vaccine passports be destroyed and that the passports be decommissioned once the pandemic is over, or sooner if they are determined to no longer be a necessary, effective and proportionate measure for addressing their intended public health purpose.
In Our View
Navigating novel workplace issues related to the COVID-19 pandemic, including those related to immunization, has been incredibly challenging for many. Employers in the public and private sectors alike who are considering introducing vaccine passports will be pleased to now have some concrete guidance on the issue, at least in terms of what privacy concerns must be considered and addressed in developing and implementing such a measure.
For more information on your rights and obligations as an employer dealing with COVID-19 or related issues, please contact Porter Heffernan at 613-940-2764 or Mélissa Lacroix at 613-940-2741.
