PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT PI21-00003

University of Guelph

April 5, 2022

Summary: The Office of the Information and Privacy Commissioner of Ontario received three related privacy complaints about the University of Guelph (the university). The complaints concerned the university’s collection of information relating to the COVID-19 vaccination status of students who wished to live on residence for the 2021–2022 academic year. The complainants believed that the collection breached the students’ privacy under the Freedom of Information and Protection of Privacy Act  (the Act ).

This report finds that the information at issue is “personal information” as defined in section 2(1)  of the Act . It also finds that the collection of the personal information and the notice of collection were in accordance with sections 38(2)  and 39(2)  of the Act , respectively.

Statutes Considered: Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.  31, as amended, sections 2(1) , 38(2)  and 39(2) ; The University of Guelph Act, 1964 S.O. 1964, c.120 as amended by 1965, c.136, sections 3 and 11; O. Reg. 364/20, Rules for Areas at Step 3 made under the Reopening Ontario (A Flexible Response to COVID-19) Act, 2020, S.O. 2020, c. 17, sections 3  and 2(2)  under Schedule 1, and section 13  under Schedule 2.

BACKGROUND:

[1] The Office of the Information and Privacy Commissioner of Ontario (the IPC or this office) received three related complaints from the parents of students registered to attend the University of Guelph (the university). The students had also been accepted to live in the university’s campus residences (the residences).

[2] According to the complainants, for the 2021-2022 academic year (2021-22), in order for the students to live in the residences, the university required that they be fully vaccinated against the coronavirus disease (COVID-19) [1] or receive an exemption from this requirement based on medical or other grounds protected under the Ontario Human Rights Code  (the Code ). [2]

[3] To prove their COVID-19 vaccination status, the complainants advised that the students had to fill out and submit a questionnaire (the COVID-19 Questionnaire) to the university. Further, they advised that students who sought an exemption still had to submit the questionnaire. However, the complainants claimed that the students were not required to submit the questionnaire when the university accepted their applications to live in the residences.

[4] In the complainants’ view, the COVID-19 Questionnaire is in effect a “vaccine passport”. In support of their position, the complainants referenced the May 19, 2021 “Joint Statement by Federal, Provincial and Territorial Privacy Commissioners” (the Privacy Commissioners’ Joint Statement). [3]

[5] In this statement, the Commissioners explained that a vaccine passport “essentially functions to provide an individual with a verified means of proving they are vaccinated in order to travel or to gain access to services or locations.” They also advised that “vaccine passports must be developed and implemented in compliance with applicable privacy laws”.

[6] The complainants also believed that the university’s collection of the students’ COVID-19 vaccination status information (the vaccination information) was not in accordance with the Freedom of Information and Protection of Privacy Act (the Act).

[7] To address this matter, the IPC opened a Commissioner-initiated privacy complaint file and commenced an investigation to review the university’s practices relating to its collection of the vaccination information at the start of 2021-2022.

[8] In response to the complaint, the university provided this office with a copy of its COVID-19 Vaccination Policy, as well as other relevant information discussed below.

[9] The university confirmed to this office that, for 2021-22, it required that (Canadian and International) students living in the residences provide proof that they were fully vaccinated against COVID-19.

[10] Under the university’s COVID-19 Vaccination Policy, “Fully Vaccinated” “means having the full series of a particular COVID-19 Vaccine or a combination of COVID-19 Vaccines and having at least fourteen (14) days elapsed since the second dose of the COVID-19 Vaccine.”

[11] Further, under this policy, “COVID-19 Vaccine” is defined as “a Health Canada or World Health Organization approved vaccine” and “Proof of Vaccination” is defined as “a written vaccination record of an Individual’s COVID-19 immunization date(s) issued by the government of the province, territory, or country in which they were immunized.”

[12] The university advised that the full COVID-19 vaccination requirement came into effect on July 22, 2021 and that it gave notice to students who wished to live in the residences by email on July 22, 2021 and on August 28, 2021. [4]

[13] Moreover, the university advised that, to address questions that these students had about its COVID-19 Vaccination Policy, the university emailed them a link to its “COVID-19 Vaccination FAQs” webpage on July 22 and 29, 2021. [5]

[14] The university also confirmed that, for 2021-22, students who wished to live in the residences had the opportunity to request an exemption from the full COVID-19 vaccination requirement based on grounds protected under the Code . To that end, the university advised that, on August 30, 2021, it emailed these students to instruct them to submit an updated exemption form and the appropriate documentation by September 7, 2021. [6]

[15] Where a student in the residences did not submit proof of full COVID-19 vaccination, the university advised that the student had to submit proof that they received a first dose of an approved COVID-19 vaccine before their move-in date and no later than September 7, 2021. The university also advised that the student had to arrange for a second dose as soon as possible and no later than September 28, 2021.

[16] Further, where a student received an exemption or was not fully vaccinated, the university advised that the student had to provide proof of ongoing rapid testing. Moreover, where a student was unable to comply with any of the aforementioned requirements before their move-in-date, the university advised that the student could request that its Student Housing Services department hold their space in the residences until the first day of classes, which was September 9, 2021.

[17] The university explained that, for 2021-22, its collection of the vaccination information was necessary to the proper administration of a lawfully authorized activity pursuant to section 11 of the University of Guelph Act, 1964 (the University of Guelph Act) [7] and O. Reg. 364/20, Rules for Areas at Step 3 and at the Roadmap Exit Step [8] .

[18] Therefore, the university took the position that the collection of this information was in accordance with the Act .

ISSUES:

[19] I identified the following issues as arising from this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Was the collection of the personal information in accordance with section 38(2) of the Act ?
3. Is the notice of collection in accordance with section 39(2) of the Act ?

Issue 1: Is the information at issue “personal information” as defined by section 2(1) of the Act?

DISCUSSION:

[20] In this matter, at issue is the vaccination information collected by the university from students when they fill out and submit the COVID-19 Questionnaire.

[21] The COVID-19 Questionnaire asks students for the following information, as applicable:

• the number of vaccination doses they have received;
• whether they have booked a first or second vaccination appointment;
• whether they plan to get vaccinated;
• their vaccination plan for obtaining a first and second vaccination dose;
• whether they are requesting an exemption;
• the date of their first appointment;
• the type of vaccination they received at their first appointment;
• the date of their second appointment;
• picture proof of their first dose;
• picture proof of their vaccination receipt; and
• their signature.

[22] Under section 2(1) of the Act , “personal information”, in part, means:

“personal information” means recorded information about an identifiable individual, including,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

…

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[23] The determination of what is “personal information” is based on the information itself and the context in which it appears. [9] Further, the test to determine whether a given record contains personal information is whether it is reasonable to expect that an individual may be identified if the information is disclosed. [10]

[24] Based on the information that a student discloses when they fill out the COVID-19 Questionnaire, it would contain information relating to their medical treatment history for COVID-19, as well as their signature.

[25] In my view, it is reasonable to expect that a student may be identified if this questionnaire is disclosed. Moreover, information relating to an individual’s medical history is information described in paragraph (b) under the definition of “personal information” in section 2(1) . The university agrees and, therefore, there is no dispute about whether the information at issue is “personal information” within the meaning of section 2(1) .

[26] For these reasons, I find that the information at issue is “personal information” within the meaning of section 2(1) of the Act .

Issue 2: Was the collection of the personal information in accordance with section 38(2) of the Act?

[27] Section 38(2) of the Act  prohibits the collection of personal information other than in certain limited circumstances. This section states:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

[28] With respect to this section, the university explained that the collection of the personal information at the start of 2021-22 was necessary to the proper administration of a lawfully authorized activity pursuant to section 11 of the University of Guelph Act, as well as O. Reg. 364/20, Rules for Areas at Step 3 and at the Roadmap Exit Step.

[29] Accordingly, first, the university must show that the activity at issue is “lawfully authorized”. Here, it is important to note that this activity, while related to the activity of collecting personal information, is not necessarily identical to it. That is, the lawfully authorized activity forms the context within which the collection would occur. [11]

[30] Second, the university must show that the collection was necessary to the proper administration of that activity. “Necessary” in this circumstance means more than merely helpful. As a result, a collection of personal information that was only merely helpful to the proper administration of a lawfully authorized activity would not meet the “necessary” standard. [12]

The University of Guelph Act

[31] Section 11 of the University of Guelph Act, in part, states:

Except as to such matters by this Act  specifically assigned to the Senate, the government, conduct, management and control of the University and of its property, revenues, expenditures, business and affairs are vested in the Board which has all powers necessary or convenient to perform its duties and achieve the objects and purposes of the University,… [13]

[32] The “objects and purposes” of the university are set out in section 3 of the University of Guelph Act. This section states:

The objects and purposes of the University are,

(a) the advancement of learning and the dissemination of knowledge, including, without limiting the generality of the foregoing, the advancement of learning and the dissemination of knowledge respecting agriculture; and

(b) the intellectual, social, moral and physical development of its members and the betterment of society.

[33] With respect to section 11, the university advised that the lawfully authorized activity is the university’s management of its affairs with all the powers necessary or convenient to perform its duties and achieve its objects and purposes set out in section 3 . I further note that, in accordance with section 14(3) of the same act, the Board may confer such powers to the President of the university who “has supervision over and direction of the academic work and general administration of the university and the teaching staff, officers and servants and students thereof”.

[34] Based on the broad wording of its enabling statute, I accept the university’s position and, therefore, I am satisfied that the management and administration of the university to achieve its objects and purposes, which include “the intellectual, social, moral and physical development of its members and the betterment of society”, is a lawfully authorized activity.

[35] Next, I must consider whether the university’s collection of the vaccination information at the start of 2021-22 was necessary to its proper management of its affairs in order to achieve its objects and purposes.

O. Reg. 364/20, Rules for Areas at Step 3

[36] In July 2021 when the university’s COVID-19 vaccination requirement came into effect, O. Reg. 364/20, Rules for Areas at Step 3 (O. Reg. 364/20), which is an earlier version of O. Reg. 364/20, Rules for Areas at Step 3 and at the Roadmap Exit Step, was in effect. [14]

[37] Section 3 of O. Reg. 364/20 states:

This Order applies to the areas listed in Schedule 3 to Ontario Regulation 363/20 (Steps of Reopening) made under the Act . [15]

[38] In July 2021, the Wellington-Dufferin-Guelph Health Unit (the Guelph Health Unit) was an area listed in Schedule 3 to O. Reg. 363/20. [16] Further, the university’s public health unit is the Guelph Health Unit. [17]

[39] As part of the general rules for areas at Step 3 of reopening in Ontario, section 2(2) under Schedule 1 of O. Reg. 364/20 required that a business or organization permitted to be open operate as follows:

The person responsible for a business or organization that is open shall operate the business or organization in compliance with the advice, recommendations and instructions of public health officials, including any advice, recommendations or instructions on physical distancing, cleaning or disinfecting. [18]

[40] Further, section 13 under Schedule 2 of O. Reg. 364/20, made it clear that post- secondary institutions, such as the university, “may open to provide in-person teaching or instruction if they comply with [certain] conditions”, which in this case, under section 2(2)  under Schedule 1 of O. Reg. 364/20, required compliance with the advice, recommendations and instructions of the Guelph Health Unit.

[41] The university explained that, in July 2021, it implemented the full COVID-19 vaccination requirement for students who wished to live in the residences based on the advice and recommendations that it received from relevant public health authorities.

[42] Specifically, the university advised that it received a July 21, 2021 letter from the Guelph Health Unit that stated:

I am writing to recommend in the strongest possible terms that the University of Guelph require a full (two-dose) course of COVID-19 vaccines for all students living in residence during the 2021-22 school year. Additionally, the University should continue to recommend strongly that all other students, faculty and staff receive both doses of the vaccine.

Students beginning or returning to their studies this fall are looking forward to a safe and relational post-secondary experience. Adding this significant layer of protection will help create a more normal fall on campus. Strong vaccination rates across the University are an important part of student physical and mental well-being, and should contribute peace of mind to all Gryphons.

…Requiring vaccinations for students living in residence is consistent with the best current scientific understanding of COVID-19 and the University’s mission to improve life. Making this a requirement in residence will help all members of campus return to a more normal campus experience and avoid a serious surge in cases this fall, especially in these congregate settings.

[43] Moreover, the university advised that it received an August 24, 2021 letter from the Council of Ontario Medical Officers of Health (COMOH), which is a section of the Association of Local Public Health Agencies, [19] that stated:

On behalf of the Council of Ontario Medical Officers of Health (COMOH), which represents the Medical Officers and Associate Medical Officers of Health in all 34 public health units across the province, I am writing to express our strong support for COVID-19 vaccination policies in all Ontario universities and colleges. This letter is our collective recommendation to Ontario universities and colleges. We consulted with the office of the Chief Medical Officer of Health Dr. Kieran Moore.

The COVID-19 pandemic has greatly impacted post-secondary campuses and their surrounding communities. The risk of COVID-19 has been highlighted by outbreaks among post-secondary students, both on and off campus. Furthermore, in Ontario, the age cohort with the highest cumulative number of cases has been amongst those who are students at post-secondary institutions, specifically aged 20-29. Unfortunately, vaccination uptake amongst the general population within this age group has plateaued.

The virus will continue to circulate this fall and it is important to create the conditions that will allow students to return to in person education and the post-secondary sector to operate with appropriate public health measures in place during the covid pandemic.

On August 17, 2021, the Chief Medical Officer of Health indicated that mandatory vaccination policies will be required for post-secondary institutions, with specific minimum requirements. As post-secondary institutions continue to develop these policies and to ensure a safer return to campus this September, the Council of Medical Officers of Health strongly recommends that:

· Full vaccination against COVID-19 be required for all individuals involved in any in-person activities on campus (students, staff, faculty, contractors, and visitors), with the rare exception of those individuals who cannot be vaccinated due to permitted exemptions (medical and other protected grounds under the Ontario Human Rights Code ). Individuals are to be required to submit proof of vaccination.

· All individuals who are unvaccinated due to permitted exemptions or who are awaiting their second dose be required to adhere to additional health and safety measures, up to and including serial and frequent rapid testing.

· Individuals involved in any in-person activities on campus (students, staff, faculty, contractors, and visitors) should be fully vaccinated as soon as operationally feasible.

Vaccination against COVID-19 is the single most effective public heath measure to reduce the spread of COVID-19. Its inclusion among the other public health measures (including physical distancing, capacity limits, and indoor mask use) is essential in the response to the COVID-19 pandemic. Rapid testing protocols are not preventive and are not a replacement for immunization and should be used only in instances where vaccination is not possible.

High vaccine uptake in Ontario, including amongst post-secondary communities, will be essential to ensure a safe and healthy autumn…

[44] As an organization allowed to be open at Step 3 of reopening in Ontario, the university explained that, at the start of 2021-22, its collection of the vaccination information was necessary in order for it to comply with the advice, recommendations and instructions of the Guelph Health Unit and the COMOH, which strongly recommended that all students be fully vaccinated against COVID-19.

[45] More specifically in the Guelph Health Unit’s letter, it was recommended “in the strongest possible terms that the [university] require a full (two-dose) course of COVID- 19 vaccines for all students living in residence during the 2021-22 school year.”

[46] The Guelph Health Unit affirmed that “(s)tudents beginning or returning to their studies this fall are looking forward to a safe and relational post-secondary experience. Adding this significant layer of protection will help create a more normal fall on campus.” This health unit also affirmed that “(s)trong vaccination rates across the (u)niversity are an important part of student physical and mental well being, and should contribute peace of mind to all (students).”

[47] Further, the Guelph Health Unit explained that “(r)equiring vaccinations for students living in residence is consistent with the best current scientific understanding of COVID-19 and the University’s mission to improve life” and strongly recommended that “(m)aking this requirement in residence will help all members of campus return to a more normal campus experience and avoid a serious surge in cases this fall, especially in these congregate settings.”

[48] Similarly, for 2021-22, the COMOH advised that “(v)accination against COVID-19 is the single most effective public health measure to reduce the spread of COVID-19” and that “(h)igh vaccine uptake in Ontario, including amongst post-secondary communities, will be essential to ensure a safe and healthy autumn.”

[49] Accordingly, the university believed that its collection of students’ vaccination information was in line with the advice, recommendations or instructions of the Guelph Health Unit and the COMOH set out in their letters, discussed above.

[50] Moreover, the university explained that, for 2021-22, its collection of the vaccination information was necessary as a part of its ongoing health and safety efforts to protect its students in the residences (who live closely with many others) and elsewhere on campus by preventing the spread of COVID-19 and creating a safer space for everyone.

[51] In my view, the university could only ensure that students living in the residences (or on campus), were fully vaccinated against COVID-19 by collecting the vaccination information.

[52] For the aforementioned reasons, I am satisfied that the university’s collection of the vaccination information was “necessary” and not merely helpful to its proper compliance with the advice, recommendations or instructions of the Guelph Health Unit and the COMOH required by section 2(2)  under Schedule 1 of O. Reg. 364/20.

[53] Accordingly, I am satisfied that this collection was necessary to the proper administration of the university’s lawfully authorized activity of managing its affairs in accordance with section 11 of the University of Guelph Act in order to achieve its objects and purposes, which include “the intellectual, social, moral and physical development of its members and the betterment of society.”

[54] Therefore, I find that the collection of the personal information by the university was in accordance with section 38(2) of the Act .

[55] I note that this finding is in line with the Privacy Commissioners’ Joint Statement that advises that “vaccine passports must be necessary to achieve each intended public health purpose. Their necessity must be evidence-based and there must be no other less privacy-intrusive measures available and equally effective in achieving the specified purposes.”

The Amount of Personal Information Collected

[56] An important privacy consideration when collecting personal information involves the principle of “data minimization”. The IPC has described data minimization as a fundamental principle of data protection and defined it as “the practice of limiting the collection of personal information to that which is directly relevant and necessary to achieving a specified purpose.” [20]

[57] This consideration was also noted in the Privacy Commissioners’ Joint Statement that advises that “the collection….of personal health information should be limited to that which is necessary for the purposes of developing and implementing vaccine passports.”

[58] Accordingly at issue, is whether the university limited the collection of personal information to that which was directly relevant and necessary to achieving a specified purpose. In this matter, as indicated above, the purposes being the university’s compliance with the advice, recommendations and instructions of public health officials, as well as its management of its affairs to achieve its objects and purposes.

[59] As previously stated, through the COVID-19 Questionnaire, the university collected the following vaccination information, as applicable, from students who wished to live in the residences for 2021-22:

• the number of vaccination doses they have received;
• whether they have booked a first or second vaccination appointment;
• whether they plan to get vaccinated;
• their vaccination plan for obtaining a first and second vaccination dose;
• whether they are requesting an exemption;
• the date of their first appointment;
• the type of vaccination they received at their first appointment;
• the date of their second appointment;
• picture proof of their first dose;
• picture proof of their vaccination receipt; and
• their signature.

[60] With respect to this information, the university explained that it was necessary to collect it in order to determine whether a student:

• has taken a full (two-dose) course of COVID-19 vaccines;
• intends to take a full (two-dose) course of COVID-19 vaccines but have not yet reached the date of vaccination appointment(s);
• intends to take a full (two-dose) course of COVID-19 vaccines
• who does not intend to take a full (two-dose) course of COVID-19 vaccines intends to request an exemption on grounds under the Code ;
• is on their way to taking a full (two-dose) course of COVID-19 vaccines by taking the first dose; and
• took a dose that is approved by Health Canada or the World Health Organization.

[61] In my view, without collecting the vaccine information requested through the COVID-19 Questionnaire, for the start of 2021-22, the university would have been unable to make any of these determinations and, ultimately, obtain proof of full COVID-19 vaccination for students in the residences, which was required to achieve its purposes of complying with the advice, recommendations and instructions of public health officials, and managing its affairs to achieve its objects and purposes.

[62] For this reason, in my view, the personal information collected by the university was directly relevant and necessary for these purposes. Further, there is nothing before me to suggest or demonstrate that the university collected a greater amount, or other types, of personal information relating to students’ COVID-19 vaccination status.

[63] Therefore, I find that the university’s collection of the vaccination information was in accordance with the data minimization principle.

Issue 3: Is the notice of collection in accordance with section 39(2) of the Act?

[64] Because, at the start of 2021-22, the university collected the vaccine information from students who wished to live in the residences, section 39(2) of the Act  requires that they receive certain notice about the collection. [21]

[65] Section 39(2)  states:

Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,

(a) the legal authority for the collection;

(b) the principal purpose or purposes for which the personal information is intended to be used; and

(c) the title, business address and business telephone number of a public official who can answer the individual’s questions about the collection.

[66] With respect to the notice required by section 39(2) , the IPC Practices No. 8 “Providing Notice of Collection” (IPC Practices No. 8) [22] states:

Notice may be provided either orally – in person, over the telephone; or in writing – on an application form, on a posted sign, in a newspaper ad; or in any other manner which informs the individual about the collection.

[67] Another manner may include making the notice available and easily accessible on a website. [23]

[68] Further, IPC Practices No. 8 recommends that institutions “cite the proper legal authority that permits the collection by referring to the specific act and section that authorizes the collection”, or “provide the specific section of an act or by-law which authorizes the activity or program for which the information must be collected.”

[69] It also recommends that institutions “fully inform the individual from whom the information is collected about how the information will be used” and ensure that they “will have no difficulty in contacting someone who can provide answers to questions or additional information about the collection.”

[70] The university advised that the notice of collection for the personal information is located on the Student Wellness Services online portal. The university explained that, before students disclosed their vaccination information through the COVID-19 Questionnaire, they were directed to read and acknowledge the notice, which sets out how the information will be collected, used and disclosed.

[71] The notice of collection states:

The personal information referred to above is collected under the authority of the University of Guelph Act, 1964 (as amended), and will be used only as set out above. Any questions about this collection should be directed to [a named individual], Director, [the named individual’s business address and business telephone number].

[72] Based on this, I am satisfied that the university has provided the notice required by section 39(2)  and, therefore, I find that the notice of collection of the personal information is in accordance with this section.

[73] I note that this finding is in line with the Privacy Commissioners’ Joint Statement that advises that “Canadians should be informed about the purposes and scope of vaccine passports and about the collection…of their personal health information for the purposes of vaccine passports” and that “individuals should be informed about who to contact to request access to, and correction of, any information available through vaccine passports or to make an inquiry or complaint about vaccine passports.”

[74] However, I also noted that the university’s notice of collection did not refer to the specific section, that is, section 11, under the University of Guelph Act that authorized the collection of the vaccination information.

[75] I raised this concern to the university and, in response, the university confirmed that it has updated the notice of collection to refer to this specific section.

CONCLUSION:

Based on the results of my investigation, I have reached the following conclusions:

1. The information at issue is “personal information” as defined by section 2(1) of the Act .
2. The collection of the personal information was in accordance with section 38(2) of the Act .
3. The notice of collection is in accordance with section 39(2) of the Act .

Original Signed by:		April 5, 2022
John Gayle
Investigator

 

POSTSCRIPT:

Given the evolving nature of COVID-related regulations in response to the spread of the pandemic and corresponding changes in public health advice and recommendations, my decision above regarding the lawful collection of students’ vaccine information must be read in the context that existed at the beginning of the 2021-22 academic school year.

Whether collection of this information can continue to be justified in future school terms must be continually reassessed and re-evaluated in accordance with applicable Ontario regulations and public health advice as they exist at that time.

This is consistent with the Privacy Commissioners’ Joint Statement, which affirmed that the “necessity, effectiveness and proportionality of vaccine passports must be continually monitored to ensure that they continue to be justified. Vaccine passports must be decommissioned if, at any time, it is determined that they are not a necessary, effective or proportionate response to address their public health purposes.”