Yahoo Finance No clear guidance on whether Ontario businesses can track vaccine status
The Ontario government has mandated certain businesses must ensure patrons are fully vaccinated, but the province has not set clear guidelines on whether those businesses can create a database of each individual's vaccination status, which concerns privacy experts.
The Reopening Ontario Act clearly states businesses cannot keep a copy of a person's vaccination record. No clear law exists, however, to prevent a business from creating its own record indicating they have previously verified one's vaccine status.
According to privacy lawyer Constantine Karbaliotis, the rules could allow for a business — such as a fitness centre where customers return several times a week — to create their own records to speed up the process of checking vaccine status.
"You check the box and say they presented the right information," Karbaliotis said.
GoodLife Fitness, for example, has a "fast pass" system where the club can mark down a member has previously shown the required proof of vaccination, rather than showing their documents every time they enter. GoodLife says the fast pass is optional and members can opt out at anytime.
"The Fast Pass does not store vaccination information, but instead indicates if a member meets the provincially mandated requirements to enter the club for which they are located," Tracy Matthews, vice-president of operations at GoodLife, said in an emailed statement.
When asked by CBC if such a process is allowed, a spokesperson for the Ontario Ministry of Health only said businesses or organizations "may wish to consult with legal counsel."
Karbaliotis said government guidance "would be helpful," especially for smaller businesses.
"This is the challenge for many organizations because they don't necessarily have privacy counsel available to them," he said.
Former Ontario privacy commissioner Ann Cavoukian reminds people to be cautious with their health information even if a business doesn't keep a copy of the official document.
"Health information is the most sensitive personal information that exists," she said, adding that her main concern is a business retaining a person's vaccination status indefinitely.
"To think that none of this information is going to be retained, unfortunately in my view, is dreaming."
The government has maintained the vaccine certification system is only a temporary measure, but Cavoukian isn't convinced businesses will automatically purge the information they've collected.
'Retention is an Achilles' heel'
Karbaliotis agrees retention could be an issue and organizations that wish to keep a record of vaccine certification need to have a plan for how to get rid of that record.
"Retention is an Achilles' heel for many many companies because they over-retain information," he said.
The new scannable QR code system could help by allowing patrons to return to a business and gain quick entry without the business retaining their information, Karbaliotis said.
Government officials said the QR scanner app called Verify Ontario will reveal less personal information than the current vaccine receipts do as they don't indicate a brand or brands of vaccine a person received, or the specific dates of their shots.
The use of the QR code is not mandatory, though, and Ontarians can continue to use their vaccine receipt if they wish, which Karbaliotis said might confuse business owners.
Despite the new QR system, Cavoukian remains skeptical information retention will disappear.
