Businesses are in a tight spot when it comes to proof of vaccinations, says privacy lawyer
Many businesses don't have the time, information or legal advice to make these assessments: Molly Reynolds
As provinces take steps toward post-COVID normalcy, more questions are being raised about proof of vaccinations and how they're impacted by privacy laws — from both consumers and businesses.
On July 12, Quebec lifted capacity restrictions in retail stores and lowered social distancing from two metres to one metre. A couple of days later, Nova Scotia entered Phase 4 of its five-step reopening plan. Ontario entered Step 3 of its plan on Friday.
Those provinces join regions like British Columbia and Alberta, which moved into Step 3 of their plans earlier this month.
Molly Reynolds is a lawyer specialising in privacy, data security and protection and ethics. She spoke to Checkup guest host Michelle Eliot about the tough spot businesses are in when it comes to privacy rights and requesting proof of vaccinations.
Here is part of their conversation.
Can a restaurant or any other business legally require proof of vaccine before allowing patrons in?
It's a tough question right now for businesses, especially in the hospitality area.
Where we're at right now is there isn't firm guidance from the federal or provincial governments saying that certain businesses or industries are allowed to restrict access to their services to those who are vaccinated, but nor is there guidance prohibiting that.
What businesses have to do is look at the various different legal regimes — privacy law, human rights, employment law, and health and safety on the job — and do an analysis of whether the necessity of protecting public health is effectively outweighing the intrusion on privacy by asking people to provide a proof of vaccine.
That's quite challenging for businesses right now because many of them don't have the time, the information or the legal advice to make that assessment.
As they weigh those considerations, is the pandemic a justifiable reason to ask people to disclose health data?
Well, we can't say that universally that is such a public health concern that they can require the disclosure of this type of information. However, there certainly are some industries and some businesses or workplaces where that argument is going to be stronger. For example, those who are serving high-vulnerability people.
By contrast, there may be industries or businesses where the work is primarily outside, or social distancing and masking continues to be viable. And in that case, it's difficult to say we have to require people to provide this type of personal health information if there are alternatives available.
As you say, so far, it seems businesses are having to figure out on their own how to do this. Is there a more effective way to do that without perhaps infringing on people's human rights and privacy?
So a business might say, "We would ask you not to come in person if you haven't been vaccinated," and highlight the contact list or the remote options for obtaining their services for those who aren't vaccinated.
That's probably the lowest risk option for businesses, but doesn't give their customers and their employees the confidence that so many people are looking for in going into environments where they know everyone around them are going to be fully vaccinated.
A business may have to either allow individuals to access services or go quite far to provide them with alternative means, for example, of remote or contactless access to those services.- Molly Reynolds
And when it comes to private sector businesses, how does that compare to public services when it comes to charter rights?
It's different legal regimes that apply to the public sector versus the private sector, but actually most of them still have to comply with the same type of balancing of determining the necessity of protecting people through requiring proof of vaccination versus the privacy impact.
However, in the public sector, it's much more difficult to enact rules that would require people to either not access necessary services or to provide their personal health information.
It can actually be more challenging in the public sector. For example, if somebody wasn't able to access a government office to have their I.D. renewed because they didn't want to volunteer their COVID status or because they hadn't been vaccinated.
There are people who can't get vaccinated for health or religious reasons. How can these establishments handle those exceptions?
That's one of the areas where we do have firmer guidance under human rights legislation across the country.
So if somebody is medically ineligible for a vaccine, that could be considered a basis of discrimination for disability status if people were denied services as a result.
Similarly, if somebody has chosen not to take a vaccine because of a truly-held religious belief, that would be a human rights code ground, where somebody can't be denied service on that basis.
A business may have to either allow individuals to access services or go quite far to provide them with alternative means, for example, of remote or contactless access to those services.
Ultimately, do you see federal or provincial governments introducing the kinds of guidelines that you're saying are missing right now — legislation to provide that clarity?
I'm hopeful.
There was a lot of confusion earlier in the pandemic around certain types of testing or screening that was permissible for the public or the private sector to do before offering access. And we didn't end up seeing a lot of guidance from the government.
However, we did see some commentary over the months around what may not be effective. For example, some public health agencies were mentioning that temperature checks weren't necessarily effective means of screening for COVID and therefore might not [meet] that permissible balance of necessity against privacy intrusion.
So I think the question of vaccine status is going to be relevant for many months to come. I expect that public health and hopefully other agencies, like human rights agencies and privacy regulators, will work together so that there can be provincial or federal guidance on the type of workplace where these types of restrictions may be appropriate and wouldn't put the business at risk of being offside of privacy law.
Written by Mouhamad Rachini. Produced by Steve Howard, Mikee Mutuc and Caroline Carucci. Q&A has been edited for length and clarity.
