Focus On

Canada’s privacy commissioners issue joint statement on COVID-19 vaccine passports

Thursday, May 20, 2021 @ 2:53 PM | By John Schofield


Canada’s federal, provincial and territorial privacy commissioners are urging governments, health authorities and businesses across the country to fully comply with applicable privacy laws if they develop and implement controversial COVID-19 vaccine passports.

“Above all, and in light of the significant privacy risks involved, the necessity, effectiveness and proportionality of vaccine passports must be established for each specific context in which they will be used,” the privacy commissioners warned in a joint statement issued May 19.

“The necessity, effectiveness and proportionality of vaccine passports must be continually monitored to ensure that they continue to be justified,” the statement added. “Vaccine passports must be decommissioned if, at any time, it is determined that they are not a necessary, effective or proportionate response to address their public health purposes.”

The commissioners said that vaccine passports are only justified if solid scientific evidence proves they are necessary and effective in achieving intended public heath purposes and no other less intrusive option is available.

In addition, they said, the privacy risks associated with vaccine passports should be proportional to the public health purposes they are intended to address and should be subject to “data minimization” so the least possible amount of personal health information is collected, used or disclosed.

Governments and businesses must ensure that vaccine passports are based on legal authority, said the commissioners. And that legal authority should be based not only on consent, but also on trust, they noted.

“Clear legal authority for vaccine passports,” they said, “may come from a new statute, an existing statute, an amendment to a statute, or a public health order that clearly specifies the legal authority to request or require a vaccine passport, to whom that authority is being given, and the specific circumstances in which that can occur.”

In legal terms, said the statement, a newly enacted public health order or law requiring the presentation of a vaccine passport to enter a premises or receive a service would provide the clearest authority for businesses and other entities that are subject to private sector privacy laws.

Without a special order or law, said the commissioners, simple consent could provide sufficient authority under existing privacy legislation if consent is voluntary and meaningful and is based on based on a clear, plain-language description of the purpose to be achieved.

In addition, the information the individual is providing must be necessary to achieve that purpose; the purpose must be one that a reasonable person would consider appropriate; and individuals must have a true choice. Consent must not be required as a condition of service, they said.

Under Quebec laws, the commissioners noted, consent alone cannot form the legal basis for vaccine passports. Requesting the presentation of a passport in Quebec would require that the information is necessary to achieve a specific, serious and legitimate purpose.

The commissioners’ statement also advised that the collection, use, disclosure and retention of personal health information should be limited to that which is necessary and active tracking or logging of an individual’s activities through a vaccine passport by any entity should be prohibited.

In addition, they said, Canadians should be informed about the purposes and scope of vaccine passports and about the collection, use, disclosure, retention and disposal of their personal health information. Accountability should be built in so individuals can easily contact the proper authority to make inquiries or complaints or to access or correct their information.

The commissioners said that technical, physical and administrative safeguards must be put in place that are in line with the sensitivity of the information and the effectiveness of those measures should be regularly evaluated.

To ensure accountability and trust, they said, privacy commissioners should be consulted throughout the development and implementation processes to provide independent oversight. Finally, the statement said, “personal health information collected for vaccine passports should be destroyed and vaccine passports decommissioned when the pandemic is declared over by public health officials or when vaccine passports are determined not to be a necessary, effective or proportionate response to address their public health purposes.”

Some groups have expressed concern that vaccine passports could infringe on civil liberties. 

According to an EKOS poll conducted between April and May, about three-quarters of Canadians support the idea of a vaccine passport or other proof of vaccination for international travel, but only about 40 per cent favoured being screened to get a table for indoor dining.

Similarly, an Ipsos survey conducted in March and April found strong support for using vaccine passports for travellers and large events, but more skepticism about their role in day-to-day life.

If you have any information, story ideas or news tips for The Lawyer’s Daily, please contact John Schofield at john.schofield@lexisnexis.ca or call 905-415-5891.