Bryan Thomas and Vivek Krishnamurthy
QUOI Media
Some businesses may be apprehensive as most provinces and territories begin removing vaccination passport and mask mandates. But do Canadian privacy laws prohibit them from continuing to verify patrons’ vaccination status on their own initiative?
The law in this area is notoriously complex, but the short answer is that it continues to be legitimate for many businesses to require proof of vaccination from their customers — so long as they verify vaccination status without retaining that information.
Businesses may collect and retain personal information if they can specify a ‘legitimate purpose’ for doing so which a ‘reasonable person’ would deem appropriate under the circumstances. Businesses must disclose that ‘legitimate purpose’ to their customers at the time of collection and limit their use of customer data to that purpose.
The key question is whether businesses can specify a reasonable and legitimate purpose for continuing to check patrons’ vaccination status. That should be pretty easy to do – for now.
The available science suggests that double vaccination provides some protection against transmitting the Omicron variant, while three doses provide much more protection. Regardless of the number of doses, however, this immunizing effect wanes over time. Even so, there are some settings where it would be reasonable to continue requiring vaccination as an added protection against transmission. This may include crowded public venues such as gyms, restaurants and theatres, or businesses that cater to segments of the population that are particularly vulnerable to COVID-19.
Some might argue that the provinces’ decision to lift vaccine passport requirements — a decision ostensibly guided by public health experts — signals that these measures no longer serve any legitimate purpose. But this doesn’t necessarily follow. In deciding whether to lift or retain vaccine passport requirements, public health officials will look at the matter from a macro perspective, balancing risks and benefits across diverse settings.
Vaccine requirements continue to serve a legitimate purpose in at least some private sector settings – and some provincial leaders have already urged businesses to evaluate the merits of continuing to check vaccination status on their own initiative.
Down the road, however, businesses may face practical challenges in their efforts to reduce transmission through continued vaccine passport checks.
In many provinces, vaccine passports only confirm that someone has received two doses. Thankfully in Canada, most people who have received two doses have also received a third, so this offers some assurance of reduced transmission. But as the protective effects of three doses wane with the passage of time and the arrival of new variants, the practice of continuing to check for double vaccination will become increasingly a form of public health theatre — and arguably cease to serve a legitimate purpose.
Then there is the question of method. To our knowledge, no provincial government has indicated that they will continue to update vaccine passport technologies to keep pace with the evolving science. If governments simply abandon the technology, businesses will be left to their own devices in deciding what vaccinations are required for the purposes of preventing transmission on their premises, and to devise some reliable and efficient way to verify adequate vaccination.
Perhaps private companies will pick up the baton from government and develop smartphone apps that businesses can use to quickly and reliably confirm vaccination status. Nothing in Canadian privacy law precludes the possibility of private vaccine passports — provided users are consenting, the collection and retention of personal information is minimized, and the businesses checking these passports have a legitimate and clearly explained purpose.
Unfortunately, if Canada’s COVID-19 response has a recurring theme, it is the dynamic of being too slow to apply response measures and too quick to lift them. This pandemic is far from over and we can only hope that government has learned its lesson from past indecisiveness. Private businesses shouldn’t count on this, though, and should instead make their own careful assessment of whether to persist with protective measures like vaccine passports, now and in the future.
Bryan Thomas is an Adjunct Professor, Faculty of Law at the University of Ottawa and member of the University of Ottawa Centre for Health Law, Policy & Ethics. Vivek Krishnamurthy is the Samuelson-Glushko Professor of Law at the University of Ottawa.
