By Prasanthi Vasanthakumar, Institute of Corporate Directors
We are now living in a world where health screening questions are a daily occurrence and vaccine passports may soon become a reality. Are public health and individual privacy at odds with each other? For Ann Cavoukian, Executive Director, Global Privacy & Security by Design Centre, we can and should have it both ways. “If we don’t, it will eradicate our privacy over time, which is completely unacceptable,” says the former Information and Privacy Commissioner of Ontario.
For their part, privacy regulators have been clear from the get-go that individuals’ privacy rights are not to be compromised during the pandemic, but applied contextually, says Molly Reynolds, Privacy Counsel at Torys LLP. In the absence of clear government directives on health and safety measures, organizations have to figure out where to draw the line – which is when things can get messy. “For management, it’s a struggle to conduct that assessment and balance competing operational and regulatory requirements,” says Reynolds. “For boards, the challenge is to know which questions to ask.”
Vaccine passports: Yes or no?
On the hot-button issue of proof of vaccination, the question may not be if, but when. The international community is desperate to set up systems that can prove individuals are not carrying the novel coronavirus, enabling a return to some semblance of normalcy. The ‘Green Pass’ is already live in Israel, allowing its vaccinated holders to visit gyms, cinemas and other public spaces of our pre-pandemic lives.
But vaccine passports are fraught with problems, not least of which include fairness, equity and privacy, which may be why Canada hasn’t rushed to embrace the idea.
Cavoukian agrees with the notion that vaccine passports are akin to a national caste system and spying apparatus. “You don’t know how the information will be used,” she cautions. “Vaccine passports should theoretically be used for only one purpose, which is air travel. But if they are widely used for other services, the likelihood of unauthorized access increases.”
Cavoukian is working with ID 2020 on the Good Health Pass, which is a blueprint for any type of digital passport with privacy by design embedded into it. Housed digitally, for example on mobile devices, this passport is only accessible to the owner. He or she can choose who gets to see it. This decentralized storage affords the strongest privacy protection, says Cavoukian.
Other immunization-related questions
As governments tackle the concept of vaccine passports, organizations will have their own discussions on proof of vaccine status. Can you ask employees, customers and others if they have been vaccinated? Do you go a step further and require proof of vaccination to enter premises and conduct business?
“Because these questions call for personal and sensitive information, they have implications for privacy,” says Reynolds.
There’s much to be learned from the discussions taking place at home and abroad. “Even if you are not working within a formal vaccine passport regime, you can map the principles discussed to those informal discussions around the questions you can ask people before they enter premises, and the information you can require versus request,” she says.
Privacy and cybersecurity in the time of COVID-19
With or without vaccine passports, a return to normal life is on the horizon. However, the pandemic has created new ways of doing things, which add another layer of risk, says Reynolds. The rapid migration to remote work has created new cybersecurity threats, while the health and safety regimes at those companies that have remained onsite pose privacy risks.
“Ongoing risk mitigation efforts need to be in place, whether that's in regard to new ways of accessing a network from a cybersecurity perspective, or brand-new forms of information that we're collecting about individuals,” says Reynolds.
But she notes that it’s equally important to think about what happens when these measures are no longer necessary. Who’s going to be responsible within the organization for pivoting? Who should still have remote access? And at what point should an organization stop asking invasive questions about an individual’s health status? These are critical questions to consider for what comes next.
The data dilemma
An important next step is properly dealing with data collected during the pandemic, whether archival or destruction. “Data retention is not a glamorous area, and it’s one people don’t want to dwell on,” says Reynolds. “In the context of the board and senior management, it’s also an area that’s chronically underfunded in most organizations. But if sensitive data that’s no longer needed for operational or legal purposes is then compromised in a data breach or cybersecurity incident, it can multiply the risk to an organization.”
Privacy, please
As individuals, businesses and societies have struggled to survive the COVID-19 crisis, risks have often been pitted against one another. Like the health versus economy debate, public safety versus privacy is a false dichotomy. It’s imperative that boards preserve the privacy of all stakeholders by carefully considering the implications of vaccine passports, implementing privacy by design elements in any requirements put forward, and adequately handling sensitive data.
For boards whose organizations are considering policies around proof of vaccination, privacy for the individuals concerned should be discussed from the beginning and embedded into the policy development and implementation.
“Right now, there is a trust deficit,” says Cavoukian. “When organizations go to great lengths to protect privacy, it gives them a competitive advantage. It builds trust with stakeholders like no other. Everyone wins.”
The reference shelf
Compiled by Heather Wilson, Director, Research Services
Vaccine passports
Canadian Lawyer. COVID-19 vaccine passport development must have legal and ethics expert input: medical journal (2021)
CBC. COVID-19 vaccine passports must address privacy, equity concerns, say experts (2021)
iPolitics. Privacy concerns complicate vaccine passports (2021)
New England Journal of Medicine. “Vaccine passport” certification — policy and ethical considerations (2021)
Reuters. Vaccine passports must be proportionate, legal, EU privacy watchdogs say (2021)
Bill C-11
Canada. Department of Justice. Bill C-11: An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts (2020)
CBC. Digital privacy law is being updated for the first time in decades, and it's imperative we get it right (2021)
Privacy Commissioner of Canada. Consumers and COVID-19 (2021)
Role of the board
DLA Piper. What directors and officers of Canadian organizations need to know about potential individual liability for cyber-claims (2019)
MLT Aikens. Privacy and the board – responsibilities and liabilities (2021)
Torys LLP. Data governance and Canada’s c-suite: are directors and officers liable for cybersecurity failures? (2020)
Originally published in the Director Lens Communique by the Institute of Corporate Directors.