Governments around the world are considering, or are currently in the process of implementing, vaccine passports or certificates to allow individuals to prove vaccination against COVID-19 and gain access to certain services.
As countries around the world, and some jurisdictions in Canada contemplate how or if certification of COVID-19 vaccination status will be implemented in daily life, Canadian Ombudsman are stressing a cautious approach that places fairness at the heart of any potential vaccination certification system that is applied to public services.
The Canadian Council of Parliamentary Ombudsman (CCPO) issued a guidance document today aimed at provincial and territorial public sector organizations under the jurisdiction of Ombudsman across the country. This includes agencies and government ministries providing services such as public education, housing, and health services.
“Although we are not seeing yet that people are having to show vaccination status to receive public services in Canada, with the guidance we are providing, we want to plant the seed both with public organizations, and with the public, that if this does start to happen it is done in a way that is fair, reasonable and just,” said Bill Smith, President of the CCPO and Ombudsman for Nova Scotia.
The guidance document calls on provincial and territorial governments to consider key fairness principles when contemplating COVID-19 vaccination certification approaches including:
- Clear direction for the use of vaccination certification must be given by government via legislation or publicly available policy.
- Any vaccine certification program must be evidence-informed and all decisions must be subject to review and appeal
- Accommodations must be made for those who have not received the vaccine, including alternative service delivery
- Decisions about restricting access to a service based on a person’s vaccination status must be done in a transparent, procedurally fair manner and be clearly communicated to the affected person in an accessible way.
“Implementing new measures such as vaccine passports runs the risk of creating a lot of confusion, concern and formal complaints,” said Smith. “This guidance today serves as a reminder that may help prevent unfairness from occurring if this is something governments decide to apply to their public services.”
To view the CCPO guidance document visit:
The Ombud of New Brunswick joins national colleagues in call for vaccine passports to meet the highest level of privacy protection.
May 19, 2021 – Privacy should be front and centre as governments and businesses consider COVID-19 vaccine passports as a tool to help Canadians return to normal life, say Canada’s privacy guardians.
Vaccine passports would allow people to travel and gather again and could support economic recovery while protecting public health. They would, however, require individuals to disclose personal health information about their vaccine or immunity status in exchange, potentially, for access to goods and services, for example, restaurants, sporting events and airline travel.
“While this may offer substantial public benefit, it is an encroachment on civil liberties that should be taken only after careful consideration,” federal, provincial and territorial privacy commissioners and ombudspersons say in a joint statement issued today.
“Vaccine passports must be developed and implemented in compliance with applicable privacy laws. They should also incorporate privacy best practices in order to achieve the highest level of privacy protection commensurate with the sensitivity of the personal health information that will be collected, used or disclosed,” the statement says.
The statement was endorsed during the annual meeting of federal, provincial and territorial access to information and privacy guardians. The Manitoba Ombudsman hosted the meeting, which took place virtually given the pandemic.
This statement outlines fundamental privacy principles that should be adhered to in the development of vaccine passports.
In particular, it notes that, in light of the significant privacy risks involved, the necessity, effectiveness and proportionality of vaccine passports must be established for each specific context in which they will be used.
In other words, vaccine passports need to be shown to be necessary to achieve the intended public health purpose; they need to be effective in meeting that purpose; and the privacy risks must be proportionate to the purpose, i.e. the minimum necessary to achieve it.
Further, vaccine passports, whether introduced by governments or public bodies for public services, or by private organizations, need to have clear legal authority. In addition, organizations considering vaccine passports should consult with the privacy commissioners in their jurisdiction as part of the development process.
Related documents: (link to joint statement)
For more information:
Joint Statement by Federal, Provincial and Territorial Privacy Commissioners
May 19, 2021
Vaccine passports are being considered by some governments and businesses as a means of allowing a return to something more closely resembling normal life. Canada’s Privacy Commissioners have decided to make a statement at this time in an effort to ensure that privacy considerations are at the forefront of any discussions about vaccine passport development.
A vaccine passport can take a number of different forms, such as a digital certificate presented on a smart phone app or a paper certificate, but it essentially functions to provide an individual with a verified means of proving they are vaccinated in order to travel or to gain access to services or locations. Proponents justify this measure based on the idea that vaccinated individuals have a significantly decreased risk of becoming infected and a decreased risk of infecting others. If supported by evidence of their effectiveness, vaccine passports could bring about broad and impactful benefits, including allowing increased personal liberties, fewer restrictions on social gatherings, and accelerated economic recovery resulting from greater participation in society.
At its essence, a vaccine passport presumes that individuals will be required or requested to disclose personal health information – their vaccine/immunity status – in exchange for goods, services and/or access to certain premises or locations. While this may offer substantial public benefit, it is an encroachment on civil liberties that should be taken only after careful consideration. This statement focuses on the privacy considerations.
Vaccine passports must be developed and implemented in compliance with applicable privacy laws. They should also incorporate privacy best practices in order to achieve the highest level of privacy protection commensurate with the sensitivity of the personal health information that will be collected, used or disclosed.
Above all, and in light of the significant privacy risks involved, the necessity, effectiveness and proportionality of vaccine passports must be established for each specific context in which they will be used.
- Necessity: vaccine passports must be necessary to achieve each intended public health purpose. Their necessity must be evidence-based and there must be no other less privacy-intrusive measures available and equally effective in achieving the specified purposes.
- Effectiveness: vaccine passports must be likely to be effective at achieving each of their defined purposes at the outset and must continue to be effective throughout their lifecycle.
- Proportionality: the privacy risks associated with vaccine passports must be proportionate to each of the public health purposes they are intended to address. Data minimization should be applied so that the least amount of personal health information is collected, used or disclosed.
The necessity, effectiveness and proportionality of vaccine passports must be continually monitored to ensure that they continue to be justified. Vaccine passports must be decommissioned if, at any time, it is determined that they are not a necessary, effective or proportionate response to address their public health purposes.
So far we have not been presented with evidence of vaccine effectiveness to prevent transmission, although members of the scientific community have indicated that this may be forthcoming. We recognize that scientific knowledge about COVID-19 and the vaccines is advancing quickly and discussions about vaccine passports are underway in some jurisdictions. When contemplating the introduction of vaccine passports, we recommend that governments and businesses adhere to the following privacy principles:
- Legal authority: There must be clear legal authority for introducing use of vaccine passports for each intended purpose. Public and private sector entities that require or request individuals to present a vaccine passport in order to receive services or enter premises must ensure that they have the legal authority to make such a demand or request. Clear legal authority for vaccine passports may come from a new statute, an existing statute, an amendment to a statute, or a public health order that clearly specifies the legal authority to request or require a vaccine passport, to whom that authority is being given, and the specific circumstances in which that can occur.
- Consent and trust: For vaccine passports introduced by and for the use of public bodies, consent alone is not a sufficient basis upon which to proceed under existing public sector privacy laws. Furthermore, consent alone may not be meaningful for people dealing with governments and public bodies that often have a monopoly over the services they provide. The legal authority for such passports should therefore not rely on consent alone.
For businesses and other entities that are subject to private sector privacy laws and are considering some form of vaccine passport, the clearest authority under which to proceed would be a newly enacted public health order or law requiring the presentation of a vaccine passport to safely enter a premises or receive a service. Absent such order or law, i.e. relying on existing privacy legislation, consent may provide sufficient authority if it meets all of the following conditions, which must be applied contextually given the specifics of the vaccine passport and its implementation:
- Consent must be voluntary and meaningful, based on clear and plain language describing the specific purpose to be achieved;
- The information must be necessary to achieve the purpose;
- The purpose must be one that a reasonable person would consider appropriate in the circumstances;
- Individuals must have a true choice: consent must not be required as a condition of service.
In Quebec, consent cannot form the legal basis for vaccine passports. In that jurisdiction, requesting their presentation would require that the information is necessary to achieve a specific purpose, one that is serious and legitimate.
- Limiting Collection, Use, Disclosure and Retention / Purpose Limitation: The collection, use, disclosure and retention of personal health information should be limited to that which is necessary for the purposes of developing and implementing vaccine passports. Active tracking or logging of an individual’s activities through a vaccine passport, whether by app developers, government, or any third party, should not be permitted. Also, the creation of new central databases of vaccine information nationally or across jurisdictions should not be permitted, other than the local databases necessary for the administration and verification of the vaccine. Secondary uses of personal health information collected, used or disclosed through vaccine passports must be limited to only those required or authorized by law.
- Transparency: Canadians should be informed about the purposes and scope of vaccine passports and about the collection, use, disclosure, retention and disposal of their personal health information for the purposes of vaccine passports.
- Accountability: Policies, agreements and laws must minimize any impact on privacy. Individuals should be informed about who to contact to request access to, and correction of, any information available through vaccine passports or to make an inquiry or complaint about vaccine passports.
- Safeguards: Technical, physical and administrative safeguards must be put in place that are commensurate with the sensitivity of the information to be collected, used or disclosed through vaccine passports. Processes must be put in place to regularly test, assess and evaluate the effectiveness of the privacy and security measures adopted.
- Independent Oversight: To ensure accountability and reinforce public trust, Privacy Commissioners should be consulted throughout the development and implementation of vaccine passports. Privacy Impact Assessments or other meaningful privacy analyses should be completed, reviewed by Privacy Commissioners, and a plain-language summary published proactively.
- Time and Scope Limitation: Any personal health information collected through vaccine passports should be destroyed and vaccine passports decommissioned when the pandemic is declared over by public health officials or when vaccine passports are determined not to be a necessary, effective or proportionate response to address their public health purposes. Vaccine passports should not be used for any purpose other than COVID-19.
 Vaccine passport is the most common term, which refers to a means of confirming a person’s COVID-19 vaccination or immunity status. There are others, such as immunity passport, vaccine or vaccination certificate, and digital proof of vaccination, and all of these terms may have slightly different meanings in different jurisdictions.
 According to the recent Report of the Chief Science Advisor of Canada on this issue (March 31, 2021).
Commissioner Therrien notes that:
One of the definitions of “forefront” is “the most important or leading position” (Cambridge Dictionary). I think we mean privacy should be considered at the earliest opportunity (PbD) and have an important weight, but not the most important.
Canada’s Privacy Commissioners have decided to make a statement at this time in an effort to ensure that privacy is considered at the earliest opportunity as part of any discussions about vaccine passport development.
During the Christmas period our office will be closed from December 26, 2022 to January 3, 2023 inclusive. You may make a formal complaint in writing to the attention of:
Office of the Ombud
P.O. Box 6000
Fredericton, NB E3B 5H1