Investigation into COVID-19 vaccination attestation requirements established by certain separate employers of the federal public service
The Office of the Privacy Commissioner of Canada (OPC) investigated complaints from federal public service employees against several separate employers regarding COVID-19 vaccination attestation requirements. Employees alleged that the collection, use, and disclosure of their vaccination status and accommodation requests contravened the Privacy Act. The OPC examined whether the information collected related directly to an operating program or activity (s.4) and if its uses and disclosures were authorized (s.7 and s.8). The OPC found that the collection was directly related to the employers' occupational health and safety programs and that uses and disclosures were consistent with the purpose of collection. Additionally, the OPC assessed the necessity and proportionality of these measures, concluding they were necessary and proportional given the emergency context of the pandemic. Consequently, the OPC found the complaints to be not well-founded. However, the OPC recommended that Canada Post Corporation refine its access controls for sensitive information and that all institutions conduct structured necessity and proportionality analyses for future privacy-invasive programs.
- 1Whether the information collected by the respondents related directly to an operating program or activity of the institution as required by section 4 of the Privacy Act
- 2Whether uses and disclosures of information relating to employee vaccination status and requests for accommodation were authorized under sections 7 and 8 of the Privacy Act
- 3Whether the information collected was necessary and proportional
- 4Whether the measure was demonstrably necessary to meet a specific need
- 5Whether the measure was likely to be effective in meeting that need
- 6Whether there was a less privacy-intrusive way of achieving the same end
- 7Whether the loss of privacy was proportional to the need
- Collection of personal information: Collection found to be directly related to operating program
- Use of personal information: Uses found consistent with purpose of collection
- Disclosure of personal information: Disclosures found consistent with purpose of collection
- Necessity and proportionality: Measures found necessary and proportional
- Complaint outcome: Complaints found not well-founded
- Access controls: Recommendation for Canada Post to refine access controls
- Future privacy analysis: Recommendation for institutions to conduct structured analyses
Complaints not well-founded
The collection, use, and disclosure of vaccination status information by the federal separate employers complied with sections 4, 7, and 8 of the Privacy Act, and the measures were deemed necessary and proportional in the context of the pandemic.
The OPC recommended that Canada Post Corporation review access permissions for sensitive employee information to ensure a 'need to know' basis, and that all institutions explicitly consider necessity and proportionality in a structured way when introducing or modifying privacy-invasive programs.
- s.4 Privacy Act
- s.7 Privacy Act
- s.8 Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro