This is a summary, written by members of the CITF Secretariat, of:

Thomas B, Flood CM, Krishnamurthy V, Tanner R and Wilson K. Privacy Rights and Private Sector Vaccination Requirements. Intelligence Memos. 2022 Jan 28. url:

The results and/or conclusions contained in the research do not necessarily reflect the views of all CITF members.

A commentary by a CITF-funded researcher, published in Intelligence Memos, explores the extent to which privacy laws restrict businesses’ ability to verify an individual’s vaccination status. Clarity on this issue is essential when federal and provincial governments impose vaccination mandates in some workplaces, like they did at the height of the COVID-19 pandemic. The overriding standard of “reasonableness” can guide businesses not covered by these requirements in determining the legality of verifying the vaccination status of patrons or employees depending on the context. The research was led by Dr. Kumanan Wilson (University of Ottawa).

Key points:

In situations in which a vaccine passport is desirable:

  • In Canada, many provinces have health information privacy laws, but these typically only apply to consent to the collection, use, and disclosure of personal information by healthcare professionals. This legislation does not apply to situations outside the healthcare setting in which an employer may ask employees to confirm their vaccination status.
  • In sectors and jurisdictions where employee privacy is protected, such as federally regulated industries and select provinces, the legal test is the overriding standard of “reasonableness.” Courts consider factors such as the sensitivity of the information, the business’ need for collecting the information, and the availability of less intrusive means to achieve the stated business needs, comparing costs and benefits.
  • Verifying employees’ vaccination status depends on the context. Ensuring that workers are vaccinated is crucial when working in close quarters, such as restaurant kitchens, but less important in outdoor or isolated settings.
  • Every province may be different, with some enacting regulations mandating that restaurants, theatres, and gyms verify proof of vaccination, but the information cannot be retained or used for any other purpose.
  • Businesses may request vaccination status from customers with their consent, but the legality of the request depends on how reasonable it is. In the context of an ongoing pandemic with a highly transmissible airborne virus, it is reasonable for businesses that require close physical proximity to verify customer vaccination status, but less reasonable for those that provide services from a distance.