Vaccine mandates for domestic travel
The Office of the Privacy Commissioner (OPC) investigated 18 complaints regarding the collection, use, and disclosure of vaccination information by Transport Canada, VIA Rail, and CATSA for domestic air and rail travel mandates between November 2021 and June 2022. Complainants alleged unlawful privacy violations and unreasonable limitations on mobility. The OPC found that the collection of vaccination information by CATSA and VIA Rail was directly related to their operating programs and activities, specifically administering Ministerial Orders for transportation safety. Furthermore, the uses and disclosures of personal information by CATSA and VIA Rail, and the centralized collection and use by Transport Canada, complied with sections 4, 7, and 8 of the Privacy Act. While necessity and proportionality are not direct legal requirements of the Privacy Act, the OPC assessed these principles and found the collections were overall necessary and proportional. However, the OPC identified concerns with the broad scope of the Orders' objectives and Transport Canada's limited documentation of less privacy-invasive alternatives. Consequently, the complaints were deemed not well-founded, but Transport Canada accepted recommendations for future similar measures to better define objectives and document alternative assessments. This report highlights the need to better reflect necessity and proportionality in public sector privacy law.
- 1Whether the vaccination information collected by CATSA and VIA Rail was directly related to their operating programs or activities, as required by section 4 of the Privacy Act
- 2Whether the uses or disclosures of personal information by CATSA and VIA Rail were compliant with sections 4, 7, and 8 of the Privacy Act
- 3Whether the centralized collection and use of personal information by Transport Canada was compliant with sections 4, 7, and 8 of the Privacy Act
- 4Whether the collection of information was demonstrably necessary to meet a specific need
- 5Whether the collection of information was likely to be effective in meeting that need
- 6Whether there were less privacy-intrusive ways of achieving the same end
- 7Whether the loss of privacy was proportional to the need
- Collection of vaccination info: Compliant with Privacy Act
- Use of vaccination info: Compliant with Privacy Act
- Disclosure of vaccination info: Compliant with Privacy Act
- Necessity and proportionality: Overall necessary and proportional
- Scope of Orders' objectives: Concerns identified
- Documentation of alternatives: Concerns identified
- Recommendations for future measures: Accepted by Transport Canada
Complaints not well-founded
The collections, uses, and disclosures of personal information by the institutions complied with sections 4, 7, and 8 of the Privacy Act, and the measures were found to be necessary and proportional overall.
Transport Canada accepted recommendations to more clearly define the scope of objectives and document assessment of less privacy-invasive alternatives for future similar mandatory collections.
- s.4 Privacy Act
- s.7 Privacy Act
- s.8 Privacy Act
- Treasury Board Secretariat’s Directive on Privacy Practices s.4.2.9
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro