Ontario introduces COVID-vaccine passport

On Wednesday, September 1, 2021, the Ontario government announced its plan to introduce a vaccine passport system in the province.

What you need to know

• Ontario’s plan has two phases. Beginning September 22, 2021, individuals will be required to show proof of their full vaccination status to enter certain businesses and settings in the province. The government plans to replace this with a digital vaccination certificate by October 22.
• The proof of vaccination requirements currently do not apply to employees, retail settings, and most public institution or government buildings.
• Organizations are increasingly deciding to require proof of vaccination from customers, employees and others visiting their place of business. Unless prohibited, and assuming the QR code verification app is available to them, these organizations may choose to adopt the promised digital vaccination certificate as a means of confirming vaccination status.
• Regardless of whether an organization is required to confirm vaccination status, organizations should be mindful of their evolving privacy and employment law obligations in implementing their proof of vaccination program.

The details: Ontario’s plan for vaccine passports

What it will look like

Beginning September 22, 2021, individuals must be fully vaccinated and provide proof of vaccination to access, among other things, indoor restaurants and bars, event and entertainment venues and sport facilities. Individuals are considered fully vaccinated 14 days after receiving the full series of a COVID-19 vaccine or combination of COVID-19 vaccines approved by the World Health Organization.

• Phase 1. From September 22, 2021 to October 22, 2021, individuals will be required to show proof of vaccination by showing a copy (paper or electronic) of their final dose vaccine receipt and photo ID. Individuals may download a copy of their vaccine receipt online if they did not receive (or retain) a copy of the document after receiving their final dose of a vaccine or combination of vaccines. During this phase, individuals attending weddings, funerals or meeting/event spaces will be able to provide a negative rapid antigen COVID-19 test from no more than 48 hours before the event as an alternative to proof of vaccination.
• Phase 2. Beginning October 22, Ontario will provide a “digital vaccine certificate” which will feature a unique QR code (which can be stored on a mobile device) for those who are fully vaccinated. At the same time, the government will introduce a verification app to allow businesses to scan the QR code to confirm vaccination status.

Individuals who cannot receive the vaccine due to medical exemptions will be able to access settings requiring proof of vaccination with a doctor’s note until recognized medical exemptions can be integrated as part of the government’s digital vaccine certificate. Children who are under 12 will also be exempted from these requirements.

Enforcement of Ontario’s vaccine passport system are expected to fall under the Reopening Ontario Act. Businesses may face fines for failure to comply with the vaccine passport system.

Where it will be required¹

*Ontario has indicated that it is considering some form of proof of vaccination requirement at post-secondary institutions.

Legal considerations for collecting proof of vaccination in Ontario*

Organizations implementing a proof of vaccination program will still need to comply with applicable privacy and employment law requirements, which we discussed in a prior article. However, as discussed below, Ontario’s mandate impacts the legal considerations for proof of vaccination programs—likely even in circumstances not specifically covered by Ontario’s mandate.

Customer proof of vaccination programs

Regardless of whether businesses are required to confirm vaccination status or are doing so voluntarily, businesses should ensure they are meeting their privacy law obligations by proactively developing a program that focuses on data minimization. This means that businesses should not request more information than necessary to verify the customer’s vaccination status. When the customer provides their proof of vaccination, organizations should limit the information they record (if recording the information is necessary at all). Where the data is recorded, it should be securely stored and retained only as long as necessary. Businesses should refrain from using proof of vaccination information for anything not related to confirming proof of vaccination.

Businesses not covered by the Ontario mandate will also need to confirm the necessity of any proof of vaccination program they wish to implement. Confirming necessity (i.e. that it serves a bona fide business interest) depends on the circumstances of the organization. That said, necessity is more easily established with reference to recent guidance and statements made by governments and public health officials from all levels of government (discussed further below).

Given that the details of Ontario’s plan are still being developed, businesses covered by the Ontario mandate keep abreast of new developments as they are released. The government has alluded to forthcoming guidance for businesses that will be provided “ahead of September 22 to ensure they are prepared”.

Employee proof of vaccination programs

As noted above, while patrons will need to show proof of vaccination in certain settings, the requirements do not apply to employees in affected settings. Accordingly, most employers continue to be responsible for deciding whether or not to implement proof of vaccination policies in their workplaces².

As businesses begin to consider their approaches to a return to work, they are increasingly considering whether they can or should be asking employees for proof of vaccination. Any policy which requires employees to disclose their vaccination status as a part of returning to work raises privacy concerns, which must be balanced against an employer’s health and safety obligations.

Under privacy law, an employer must be able to establish how the collection and use of vaccination status is necessary, effective and proportionate in achieving a legitimate health and safety goal. Although the law has not changed, the risk landscape associated with workplace proof of vaccination policies has changed significantly over the last several weeks, driven in part by governments moving to require proof of vaccination in various sectors (and in some cases, amongst their own employees) and government and public health officials making public statements regarding the effectiveness of COVID-19 vaccines in preventing the spread of COVID-19 in the workplace (and more broadly). Among other things, the City of Toronto recently mandated that local employers develop proof of vaccination policies that require³, at a minimum, that:

• workers provide proof of their vaccination series approved by Health Canada or the World Health Organization;
• unvaccinated employees provide written proof of a medical reason from a physician or nurse practitioner that includes whether the reason is permanent or time-limited; and
• unvaccinated workers complete a vaccination education course on the risks of being unvaccinated in the workplace.

These developments make it easier for employers to argue that proof of vaccination measures are both necessary and effective—and Ontario’s new proof of vaccination requirements may provide a further basis for employers covered by the requirements to make that argument. However, it remains important for a proof of vaccination policy to be proportionate, and employers must ensure that employees who have medical or other legally protected reasons for not being vaccinated are being accommodated to the point of undue hardship.

To the extent an employer does impose a proof of vaccination policy, it is possible that they would be able to leverage the digital vaccine certificate once it is available to confirm the vaccination status of its employees.

Importance of a dynamic analysis

As the situation on vaccinations and vaccine passports will continue to evolve, so too will businesses’ risk analyses. Guidance from privacy regulators, health officials and other government bodies—not to mention legislation explicitly authorizing or requiring collection of proof of vaccination—will impact the factors discussed above. Evidence on the efficacy of vaccines with respect to variants of concern and transmissibility will also impact a business’ risk analysis. Businesses should therefore be prepared to revisit their previous analyses as new information becomes available. In addition, businesses operating in multiple jurisdictions should consider adopting nuanced policies that take into account jurisdictional differences, including the differences between the various provincial vaccine passport mandates.

_________________________

¹ Aligned with public health measures currently in place, indoor masking policies will continue to remain in effect.

² In some settings—for example, long term care—the Ontario government has required employers to have proof of vaccination policies for staff.

³ Although framed as a “recommendation”, the regulations to the Reopening Ontario Act require businesses who are open to comply with any recommendations of public health officials.