On May 19th, 2021 Canada's Federal, Provincial and Territorial Privacy Commissioners (the “Commissioners”) released a joint statement on the privacy implications of COVID-19 vaccine passports. Vaccine passports may offer substantial public benefits; however, in exchange for access to these benefits, individuals will be required to disclose personal health information. As a result, when considering the development of a vaccine passport in Canada, the Commissioners emphasize the importance of addressing privacy considerations from the outset.
What is a Vaccine Passport?
‘Vaccine passports', digital or paper certificates documenting individuals' vaccination status, have quickly become a global topic amongst businesses, governments, and health authorities as one method of facilitating a return to normalcy, or at the very least, a way to help establish a new normal resembling pre-pandemic life. While scientific information about COVID-19 is rapidly advancing, there is evidence that fully vaccinated individuals have a significantly decreased risk of COVID-19 infection and likely have a decreased risk of spreading the infection. Vaccine passports could provide individuals with a verified means of proving they are vaccinated to travel or gain access to services or locations including, theoretically, concerts, restaurants, and workplaces.
The underlying assumption with vaccine passports is that personal health information, specifically their immunity/vaccine status, will be required or requested from individuals “in exchange for goods, services and/or access to certain premises”. As such, the Commissioners stated that any vaccine passport initiatives “must be developed and implemented in compliance with applicable privacy laws” and should also incorporate privacy best practices to ensure a high level of privacy protection that is commensurate with the sensitivity of the personal health information.
Necessity, Effectiveness, and Proportionality of Vaccine Passports
Vaccine passports will inevitably collect, use, and disclose personal health information. Consequently, the necessity, effectiveness and proportionality of the vaccine passport must be evaluated and established within the specific context in which the passport will be used. This requires evidence that the use of vaccine passports are necessary to achieve the intended public health purpose and that there are no less privacy- intrusive alternatives that are available and equally effective in achieving the specific purposes. Further, it must be likely from the outset that vaccine passports will be effective at achieving the defined purpose and must continue to be effective throughout their lifecycle. Finally, the Commissioners advocate that vaccine passports should collect, use, and disclose the minimum amount of personal health information possible.
The necessity, effectiveness and proportionality must be monitored on an on-going basis. If an organization, business, or government body is unable to meet these criteria, or ceases to meet these criteria at any time, the vaccine passport, or the request of, should be decommissioned or ceased.
Legal Authority to Require a Vaccine Passport
As a guiding privacy principal, the Commissioners state there should be clear legal authority for implementing use of vaccine passports. Legal authority is necessary for any public or private sector entity that requests or requires an individual to present their vaccine passport to receive their services or enter their premises. The basis for this legal authority may come from new legislation, existing legislation, an amendment to statute or a public health order.
The Commissioners are of the opinion that for private sector organizations, the clearest authority would be newly enacted public health order or law requiring the presentation of a vaccine passport to enter a premises or receive a service; however, absent such order or law, and relying on existing privacy legislation, the Commissioners are of the opinion that individuals' consent may provide sufficient authority if the following conditions are met:
- Consent must be voluntary and meaningful, based on clear and plain language describing the specific purpose to be achieved;
- The information must be necessary to achieve the purpose;
- The purpose must be one that a reasonable person would consider appropriate in the circumstances; and
- Individuals must have a true choice in the sense that consent must not be required as a condition of service.
While Canada is in the preliminary stages of the development of a vaccine passport, the Commissioners' joint statement underscores the importance of positioning privacy considerations at the forefront of any future initiatives, including the need for transparency, accountability and independent oversight to help reinforce public trust in the vaccine passport.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.