Vaccine Mandate Did Not Violate Privacy

Ontario’s Privacy Commissioner has ruled that a university’s COVID-19 vaccine mandate did not violate student privacy. The decision affirms that universities were empowered to adopt vaccination mandates for on-campus attendance and that collection of vaccination status from students was “necessary” in order to abide by the guidance of local and provincial public health organizations.

Details

The Office of the Privacy Commissioner of Ontario (IPC) investigation was triggered by complaints alleging that the University of Guelph’s vaccine mandate, which included a questionnaire related to vaccination status, breached privacy provided under the Freedom of Information and Protection of Privacy Act (the “FIPPA”). Those who sought an exemption from the mandate still had to submit the questionnaire. The complaint alleged that this essentially amounted to a vaccine passport. The University acknowledged that by collecting COVID-19 vaccination history, it was collecting personal information. Section 38(2) of FIPPA prohibits the collection of personal information unless the collection is expressly authorized by statute, used for the purposes of law enforcement, or necessary to the proper administration of a lawfully authorized activity. The University defended its actions by saying that collecting this information was in accordance with advice, recommendations, and directions from the Guelph Health Unit and the Council of Ontario Medical Officers of Health (COMOH). The University explained that for 2021-22 its collection of the vaccination information was necessary as a part of its ongoing health and safety efforts to protect its students in the residences and elsewhere on campus by preventing the spread of COVID-19. The IPC decision found that this collection was evidence-based and necessary to the proper administration of the University’s lawfully authorized activity of managing its affairs in accordance with section 11 of the University of Guelph Act.  The management of the University includes achieving the objects and purposes of the University described in section 3 of the University of Guelph Act as “the intellectual, social, moral and physical development of its members and the betterment of society.” On this basis, the IPC held that the collection of the personal information by the University was in accordance with section 38(2) of FIPPA.

Takeaways

While the IPC was investigating the legality of the University’s collection of vaccination information of students living on campus, in coming to its decision, the IPC concluded that the University’s collection of the vaccination information was “necessary”, not merely helpful, to its proper compliance with the advice, recommendations or instructions of the Guelph Health Unit and COMOH.

The recommendations from COMOH directed to post-secondary institutions in Ontario at the time strongly recommended that full vaccination against COVID-19 be required for all individuals involved in any in-person activities on campus (with rare exception).  The IPC’s decision supports that post-secondary institutions in Ontario were empowered to implement vaccination mandates for those attending campus in 2021-2022 based upon these COMOH recommendations.  Whether similar collections of information will be found to be “necessary” will likely depend upon the advice, recommendations, and instructions of public health at the time of the collection.

In addition, the IPC decision provides direction on the notice of collection of information to be provided in relation to vaccination information, including that it should include reference to the specific authority for the collection.

Given the evolving nature of the COVID-19 pandemic and the public health recommendations and directors, this decision must be read in the context that existed in 2021-2022 academic school year.