Privacy and Vaccine Passports
Vaccine passports have become a global topic between many businesses, governments, and health authorities as it is thought to be one method of facilitating a return to life as we once knew it. A vaccine passport acts as a way to help establish a "new norm" that may possibly resemble life pre-pandemic. However, last month Canada’s Federal, Provincial and Territorial Privacy Commissioners released a joint statement on the privacy implications of the proposed COVID-19 vaccine passports. While it is assumed that vaccine passports may offer public benefits such as travelling without the requirement to quarantine or going to a busy sports stadium, what people may not know is that in exchange for access to these "life as we once knew it" benefits it will be mandatory for individuals to disclose their personal health information.
What is a Vaccine Passport?
A vaccine passport can be either digital or in paper form and it will document an individuals' vaccination status, or immunity from COVID-19. If individuals want to return to life pre-pandemic, a vaccine passport may offer the benefits of that. However, individuals will be required to disclose their immunity or vaccine status “in exchange for goods, services and/or access to certain premises”. While it is true that information regarding COVID-19 has advanced over the last year and evidence that fully vaccinated individuals do have a decreased risk of catching and/or spreading COVID-19, the Commissioners are concerned about the implementation of a vaccine passport due to privacy reasons. As such, the Commissioners have expressed that any vaccine passport initiatives “must be developed and implemented in compliance with applicable privacy laws”. Additionally, any vaccine passport initiative should incorporate best practices to ensure protection of privacy. This comes with the sensitivity of a person's personal health information that is generally private and confidential.
Necessity and Effectiveness of Vaccine Passports
A vaccine passport will collect, use and disclose an individual's personal health information. For that reason, the necessity and effectiveness of a vaccine passport must be established with respect to how exactly the vaccine passport will be used. This would require proof that the use of a vaccine passport is in fact necessary to achieve the goal of the public health initiative to return to normal life and that there are no privacy violations as a result. In addition, it must be likely that from the beginning a vaccine passport would be effective at achieving the main goal and continue to be effective in the long term. For that reason, the necessity and effectiveness of a vaccine passport must be monitored on an on-going basis.
The Commissioners have stated that there must be clear legal authority for the implementation of a vaccine passport. In general, legal authority is necessary for any public or private entity that requires an individual to present a vaccine passport in exchange for goods and/or services. For that reason, the legal authority must be one of clear authority, such as a newly enacted public health order or legislation that requires an individual to show their vaccine passport in order to receive service or enter a premises such as a restaurant. However, if there is not such public health order or new legislation and with merely the reliance on existing privacy laws then an individual's consent may provide adequate authority if the following conditions are met:
Consent must be voluntary and meaningful, based on clear and plain language describing the specific purpose to be achieved;
The information must be necessary to achieve the purpose;
The purpose must be one that a reasonable person would consider appropriate in the circumstances; and
Individuals must have a true choice in the sense that consent must not be required as a condition of service.
Although Canada is in it's preliminary stages of the development of a vaccine passport, the Commissioners’ joint statement stresses the importance of taking privacy laws into consideration before any future initiatives to implement a vaccine passport are taken.