Can and Should you Promote your Business as ‘Fully Vaccinated’?

In the last couple of months, we’ve seen vaccination rates jump. With close to 70% of our adult population having received at least one vaccine dose and roughly 50% fully vaccinated adults, Canada has become a global leader in its Covid-19 vaccination efforts.

Here in Ontario, we are now in Phase 3 of the reopening plan. Indoor dining has resumed (with capacity limits), personal care services are back up and running, and even movie theatres have started showing flicks again.

Though there isn’t a shortage of people going out and businesses getting back on track, does it become an added selling point when your business has high employee vaccination numbers? Some businesses owners and customers tend to think so. But that doesn’t come without its issues.

There’s been a lot of literature discussing whether employers can force their employees to get vaccinated, and whether that’s a good idea. But the conversation lacks whether or not companies can or should promote to customers that they have a fully vaccinated staff.

In the context of public sector institutions in Ontario to which privacy legislation applies, as well as federally regulated employers both public and private, vaccination status falls within the definition of personal information in the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level, and the Freedom of Information and Protection of Privacy Act (FIPPA) and Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) at the provincial level.

With respect to collecting vaccination status from its employees, under PIPEDA, FIPPA and MFIPPA, an employer is required to:

• obtained informed consent
• only collect the information for a specified purpose or objective
• only use the information for purpose it was collected
• take measures to ensure that the information is not disclosed for any other reason
• safely and securely destroy information once it is no longer needed

But what about the private sector?

The acts mentioned above provide a legislative framework for only the public sector and federally regulated private employers. This means it does not apply to the majority of employers in Ontario. Businesses in Ontario and their employees are not covered under the legislative mandate like in the public sector.

Whether a business can or should promote vaccination status comes down to the scope and use of personal information and whether or not an employee has consented to the disclosure. Even without specific privacy legislation for the Ontario private sector, there are collective agreements, implied contractual terms, and possible human rights concerns that may restrict an employer from broadcasting an employee’s medical information. Improper disclosure or even reckless disregard for employees’ privacy concerns may expose businesses to liability, either in civil courts or in tribunals.

Therefore, if vaccination status is collected to advertise and promote the business to the public as “fully vaccinated”, employers should obtain consent from each employee prior to disclosing it to the public.

Business owners and employers in Ontario can rely on contracts and internal policies to deal with the issues surrounding privacy. Employers are encouraged to implement a vaccination policy that clearly outlines why collection of vaccination information is reasonably necessary, the scope of its use and disclosure, and the measures it will take to safely and securely store and destroy the information. Deciding whether you want to advertise and promote your business as “fully vaccinated” is not as simple as putting up a sign or posting on social media. To avoid the risks associated with disclosing employees’ personal information, employers should obtain employee consent. However, obtaining employees’ personal information can become an obstacle in and of itself. A well drafted vaccination policy, open communication, and consultation with your staff, will go a long way to provide staff with the information as to why you want to promote vaccination status, rather than simply mandating it. If employees are consulted and feel their privacy concerns are addressed, they may be more receptive and provide their consent to disclosing vaccination status.