Vaccine mandates for domestic travel

Complaints under the Privacy Act

May 29, 2023

---

Description

From November 2021 to June 2022, air and rail passengers in Canada were required, by Ministerial Orders issued by the Minister of Transport, to be fully vaccinated against COVID-19. We investigated whether the related collection, use and disclosure of personal information by Transport Canada, VIA Rail and CATSA was compliant with the Privacy Act (the Act). Additionally, we examined the necessity and proportionality of the measures considering the circumstances under which they were established.

Takeaways

• Transport Canada, VIA Rail and CATSA had the authority to collect personal information, including vaccination status, to administer the Ministerial orders, as this collection was directly related to their programs or activities with respect to transportation safety.
• Though the principle of necessity and proportionality is not currently a requirement of the Privacy Act, limiting the collection of personal information to what is demonstrably necessary is a requirement of the TBS Directive on Privacy Practices. We identified weaknesses in Transport Canada’s assessment and documentation, but found that the collections were necessary, effective, and proportional in the circumstances.
• To determine if a collection is necessary and proportional, the objective should be clearly and narrowly defined, to avoid overbroad interpretation.
• Institutions should clearly assess and document their consideration of potentially less privacy invasive alternatives, such as, in this case, COVID-19 testing as an alternative to vaccination status.

---

Report of Findings

Overview

From November 30th, 2021 to June 20th, 2022, all air and rail passengers traveling within or outbound from Canada were required to be fully vaccinated, per a series of Orders issued under the authority of the Minister of Transport. As a result, airlines, passenger rail services, the Canadian Air Transport Security Authority (“CATSA”), and Transport Canada collected information related to travellers’ vaccination status during this period.

We received 18 complaints under the Privacy Act (the “Act”) which alleged, to varying degrees of specificity, that the mandatory collection of medical information prior to boarding a train or plane was: (i) an unlawful violation of the complainants’ privacy and (ii) an unreasonable, unnecessary and unjustified limitation of their freedom of mobility. Some complainants specifically cited the diminishing efficacy of COVID-19 vaccines and the availability of alternatives, such as testing and natural immunity. In response, our Office investigated the federal institutions responsible for implementing and overseeing the passenger vaccine mandates (i.e., CATSA, VIA Rail and Transport Canada) for their compliance with the Privacy Act and with key privacy principles. Our investigation did not assess whether the vaccination requirements were an unjustified limitation on individuals’ freedom of mobility guaranteed by the Canadian Charter of Rights and Freedoms.

Ultimately, we found that the personal information was collected, used and disclosed to administer the Orders issued pursuant to the Aeronautics Act and the Railway Safety Act. We therefore determined the complaints to be not well-founded as: (i) the collections by CATSA, VIA Rail and Transport Canada were directly related to institutional operating programs or activities, (ii) the subsequent uses of the information were for the purposes for which the information was collected or a consistent use with that purpose, and (iii) related disclosures were authorized under Acts of Parliament.

Our Office also considered whether the collection of personal information under the Orders was necessary and proportional. ‘Necessity’ is not a legal requirement under the Act, which requires a lesser threshold of “relates directly to”, but it is a key privacy principle embedded in the privacy laws of many jurisdictions, including several Canadian provinces. In April of 2020, our Office issued a Framework for the Government of Canada to Assess Privacy-Impactful Initiatives in Response to COVID-19 and shared it with government institutions in an effort to outline key privacy principles, including necessity and proportionality, that should be considered when imposing COVID-19 response measures that have an impact on the privacy of Canadians. In May of 2021, Federal, Provincial and Territorial Privacy Commissioners recommended in a Joint Statement that governments and businesses consider the principle of necessity, effectiveness and proportionality in relation to the establishment of vaccine mandates. Several complainants specifically requested that our Office examine Transport Canada’s consideration of this principle in the issuance of the Orders.

We found that overall, the collections of personal information by VIA Rail, CATSA and Transport Canada under the Orders were necessary and proportional. However, we identified concerns with the broad scope of the Orders’ stated objective of transportation safety, and with the related risk that inappropriate or irrelevant factors could be considered when evaluating the Orders. We also identified gaps in Transport Canada’s assessment of potentially less-privacy invasive alternatives.

As a result, we recommended that if Transport Canada considers similar mandatory collections for the purpose of transportation safety in the future, it: (i) more clearly define the objectives of the measures and the scope of those objectives, and (ii) examine and document its assessment of potentially less privacy invasive alternatives. Transport Canada accepted our recommendations.

Background

1. On August 13^th, 2021, the Government of Canada announced its intent to introduce COVID-19 vaccination requirements for air and rail passengers. Subsequently, on October 6^th, 2021, the Government of Canada announced that, effective October 30th, 2021, travellers departing from Canadian airports and travellers on VIA Rail and Rocky Mountaineer trains would be required to either (i) be fully vaccinated or (ii) to show a valid COVID-19 molecular test from the past 72 hours in order to travel. They also stated that individuals who had not begun the vaccination process would risk not qualifying for travel as of November 30^th, 2021.
2. On October 29^th, 2021, Transport Canada issued two related Orders^{Footnote 1} under the Aeronautics Act and the Railway Safety Act. According to their preambles, the Order issued under the Aeronautics Act was “required to deal with a significant risk, direct or indirect, to aviation safety or the safety of the public”, while the Order issued under the Railway Safety Act was considered to be “necessary in the interest of safe railway operations”, with “safe railway operations” encompassing the safety of persons and property transported by railways as well as the safety of others persons and other property.^{Footnote 2}
3. These Orders, effective October 30^th, 2021, prohibited individuals over the age of 12 years and 4 months from:
   • (i) entering a restricted area at an airport if they could not provide a proof of vaccination credential (“PVC”) or an acceptable COVID-19 molecular test result to the screening authority, i.e., CATSA; and
   • (ii) boarding an aircraft or railway equipment if they could not provide a PVC or COVID-19 test result to their air or rail carrier, e.g., Air Canada or VIA Rail.
4. A valid PVC must have included or indicated:
   • the name of the person who received the vaccine;
   • the name of the government or the name of the non-governmental entity that issued the PVC;
   • the brand name or any other information that identifies the vaccine that was administered; and
   • the dates on which the vaccine was administered.
5. A month later, two additional Orders^{Footnote 3} were issued, which, effective November 30^th, 2021, removed the option for travellers to present the results of a COVID-19 molecular test to enter a restricted area or to board a plane/train, subject to the exceptions set out in the Orders. Exceptions were notably available for individuals who were not vaccinated due to a medical contraindication or a sincerely held religious belief, individuals who were traveling to receive an essential medical service or treatment, individuals accompanying someone who was under the age of 18 years or who had a disability, and individuals travelling to remote communities only accessible by train.
6. 18 additional orders^{Footnote 4} under the Aeronautics Act and 2 additional orders^{Footnote 5} under the Railway Safety Act had been issued since November of 2021, with each repealing and replacing the last. The core vaccination requirements of those orders, which will be referred to as the “Air Orders” and the “Rail Orders” respectively, had largely remained unchanged, with air carriers and rail operators being prohibited from allowing a person to board if they could not provide a PVC (exceptions continued to apply).
7. Since December 21^st, 2021, the Air Orders no longer required CATSA to verify PVCs prior to allowing entry into a restricted area (e.g., the terminals at an airport).^{Footnote 6}
8. On June 14^th, 2022, the Government of Canada had announced that the vaccination requirements for domestic and outbound air and rail travel would be rescinded on June 20^th, 2022.
9. The last Air Order vaccination requirement ceased to have effect on June 20^th, 2022, and, through an order^{Footnote 7} issued on June 17^th, 2022, the Rail Order’s vaccination requirement was repealed effective June 20^th, 2022 as well.

Jurisdiction

10. Most complainants asserted that restricting domestic air and rail travel to vaccinated individuals was a contravention of their mobility rights guaranteed by section 6 of the Canadian Charter of Rights and Freedoms (“the Charter”), and that therefore the Air and Rail Orders were unlawful. However, mobility rights are outside of the scope of our Office’s jurisdiction under the Privacy Act and thus outside the scope of this report’s analysis.^{Footnote 8}
11. Concerns were also raised with respect to:
    • the PVC verification applications developed and issued by the provinces and territories;
    • the vaccine mandates imposed by provinces and territories;
    • inconsistencies between vaccine mandates for federally regulated sectors, such as air and rail transportation, and provincially regulated sectors, such as certain forms of road transportation (e.g., coach bus services).
    Given that our Office does not have jurisdiction over the practices of provincial and territorial governments, our analysis is limited to assessing the compliance of federal institutions with the Privacy Act.

Analysis

Issue 1: Was the vaccination information collected by CATSA and VIA Rail directly related to their operating programs or activities, as required by the Act?

12. The complainants allege that CATSA, VIA Rail and other transportation providers lacked the authority to collect sensitive medical information, such as the immunization status of passengers.
13. Section 4 of the Act states that no personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution. Programs or activities of an institution are typically established or otherwise authorized by an Act of Parliament. Section 4 does not require a collection to be “necessary”, just that there be “a direct, immediate relationship with no intermediary between the information collected and the operating programs or activities of the government.”^{Footnote 9}
14. As described in further detail below, we determined that both VIA Rail and CATSA’s collections of travellers’ vaccination information were directly related to their operating programs given that both were required to collect the information for safety purposes under the Rail Orders and Air Orders. The Minister of Transport, in turn, was authorized under the Railway Safety Act and the Aeronautics Act to issue such Orders for the safety of the public, which includes the safety of passengers.
15. The Air Orders were issued pursuant to section 6.41 of the Aeronautics Act, which allows the Minister of Transport to make an interim order to deal with a significant risk or an immediate threat to aviation safety, aviation security or the safety of the public. Such an order may only contain provisions that may be made in a regulation of the Aeronautics Act, and according to sections 4.71 and 4.9 of that Act, regulations may be made respecting:
    • the safety of the public, passengers, crew members, aircraft and aerodromes and other aviation facilities;
    • restricted areas in aircraft or at aerodromes or other aviation facilities, including regulations respecting access to them;
    • the screening of persons entering or inside an aircraft or an aerodrome or other aviation facility; and
    • the conditions under which persons may be transported by aircraft.
16. The Rail Orders were issued pursuant to section 32.01 of the Railway Safety Act, which allows the Minister of Transport, should they consider it necessary in the interests of safe railway operations, to order a company to stop an activity that might constitute a threat to safe railway operations. Subsection 4(4) of the Railway Safety Act stipulates that, “in determining […] whether railway operations are safe railway operations, or whether an act or thing constitutes a threat to safe railway operations or enhances the safety of railway operations, regard shall be had not only to the safety of persons and property transported by railways, but also to the safety of other persons and other property.”
17. In support of the Orders’ measures, Transport Canada submitted evidence from the Public Health Agency of Canada (“PHAC”), demonstrating that in the fall of 2021, when the mandate was put in place:
    • COVID was known to be more transmissible in indoor crowded spaces;
    • The Delta variant of COVID-19, which at the time was becoming the dominant variant, was more transmissible than previous variants and risked leading to more hospitalizations and deaths in the midst of what was then Canada’s fourth wave of the pandemic;
    • The approved COVID-19 vaccines were very effective at preventing severe illness, hospitalization and death; and
    • The approved COVID-19 vaccines appeared to be somewhat effective at preventing outbreaks and the transmission of the virus, though further research was required to determine their level of effectiveness against the Delta variant;
    Transport Canada also provided evidence, from PHAC’s COVID-19 testing of travellers entering Canada between July and October of 2021, demonstrating that unvaccinated travellers were at least five times more likely than vaccinated travellers to test positive for COVID-19.
18. CATSA and VIA Rail were subject to the Air Orders and the Rail Orders respectively. As screening authorities under the Air Orders, CATSA officers were required to request that individuals provide a PVC at screening checkpoints.^{Footnote 10} As a company listed in Appendix A of the Rail Orders, VIA Rail was required to follow the procedures, including the information collection procedures, set out in the Rail Orders.^{Footnote 11} Accordingly, we consider CATSA and VIA Rail’s compliance with the Orders to be valid institutional operating programs/activities.
19. Additionally, part of CATSA’s primary operating program/activity is to screen persons who access aircraft or the restricted areas of airports to ensure transportation security,^{Footnote 12} while VIA Rail, as a railway company, is required under paragraph 3(c) of the Railway Safety Act “…to demonstrate, by using safety management systems and other means at their disposal, that they continuously manage risks related to safety matters”.^{Footnote 13} The Air Orders and the Rail Orders state their objective as being aviation safety^{Footnote 14} and safe railway operations^{Footnote 15} respectively, and thus are related to CATSA’s and VIA Rail’s other, core operating programs/activities as well.

All personal information collected was ‘directly related’

20. We also considered whether all the information collected by CATSA and VIA Rail was directly related to the administration of the Orders and its measures.

CATSA

21. Overall, CATSA’s collection of personal information was limited to that which was required to enforce the Air Orders. Information would only be recorded and retained in instances where a passenger failed to provide a valid PVC.
22. CATSA employees conducted a visual inspection of passengers’ PVCs prior to their entry into the restricted area of an airport. CATSA was required to verify the PVC of at least 8% of passengers, or to verify PVCs on a “continuously busy basis” of all eligible passengers when passenger volumes allowed, as prescribed by the Minister of Transport in a supplementary bulletin and in accordance with section 17.8 of the Air Orders. PVCs, which are referred to as “evidence of COVID-19 vaccination” in the Air Orders, contained the vaccinated individual’s name, the PVC’s issuer, the vaccine that was administered and the date it was administered.
23. CATSA never employed the use of verification applications to scan or authenticate PVCs with QR codes. Officers instead performed a visual verification of the PVC to ensure that it appeared legitimate, that it contained the necessary information, and that the name on the PVC matched the name on the passenger’s boarding pass. The information contained within a valid PVC was never recorded or retained by CATSA.
24. If the passenger did not provide a valid PVC, they were denied entry into the restricted area. In such instances, CATSA screening officers notified a supervisor, who would then fill out a ‘Vaccination Check Failure Form’ recording the traveller’s name and flight number, the date and time, the airport and screening checkpoint, and the fact that they were denied entry for failing to provide a valid PVC. As we will discuss in the following subsection, this information was collected so that CATSA could notify both the traveller’s air carrier and the Minister of Transport of the denied entry, as prescribed by the Air Orders.
25. Based on the facts outlined above, we find that the information collected by CATSA was directly related to the administration of the Air Orders, a valid operating program/activity of the institution.

VIA Rail

26. For their part, VIA Rail collected a limited amount of personal information, and only retained or recorded information where a request for an exception was made or in response to specific incidents of passenger non-compliance (e.g., failure to provide a valid PVC).
27. VIA Rail station agents, senior service attendants and service managers were responsible for verifying that passengers (i) above the age of 12 years and 4 months, (ii) who had not been granted an exception and (iii) who were accessing a VIA Rail lounge or boarding a VIA Rail train, provided a PVC.^{Footnote 16} The PVC could have been paper or digital, and for passengers originating outside of Canada, it could have taken the form of an ArriveCAN receipt with the individual’s immunization status denoted.
28. According to VIA Rail’s ‘Mandatory COVID-19 Vaccination for Passengers’ Policy, VIA Rail employees verified the identification of the passenger and confirmed that the name on the train ticket matched the name on the PVC. The employee was also required to visually confirm on the PVC that the passenger was fully vaccinated and that this status was obtained at least 14 days prior to the departure date. PVCs with a QR code were verified using the applicable PVC verification application.^{Footnote 17} VIA Rail confirmed that no additional personal information was collected from PVCs with a QR code as compared to PVCs without a QR code.
29. While the passenger’s PVC, identification and ticket were visually inspected and verified by VIA Rail employees, no personal information was retained during this process, except when the passenger had made an exception request or failed to provide a valid PVC. The Rail Orders required such events to be documented, and that the number/frequency of documented events be reported to the Minister of Transport. This information would also occasionally be used by VIA Rail to respond to complaints or claims arising from passengers who were denied boarding.
30. In light of these facts, we consider the information collected by VIA Rail to be directly related to the administration of the Rail Orders, which we consider to be a valid institutional operating program/activity.
31. VIA Rail and CATSA’s collection of travellers’ vaccination status and other prescribed information was therefore compliant with section 4 of the Act, and this element of the complaints is not well-founded.
32. The Air Orders expired and Rail Orders were repealed on June 20^th, 2022. In their news release announcing the end of the vaccine mandates, the government stated that “As the COVID-19 pandemic has evolved, so too have public health measures and advice, which includes vaccination requirements that were always meant to be a temporary measure.” The government concluded by stating that it “will not hesitate to make adjustments based on the latest public health advice and science to keep Canadians safe”, which “could include […] the reimposition of public service and transport vaccination mandates.” In this context, we note that should similar requirements be reintroduced, continuous or periodic reviews are critical to ensuring that any future collections of personal information meet the threshold of being related directly to operating programs or activities – in this case, railway and aviation safety.

Issue 2: Were uses or disclosures of personal information, and the centralized collection by Transport Canada, compliant with sections 4, 7 and 8 of the Act?

33. Several complainants expressed concern that personal information collected pursuant to the vaccine mandates could be used for surveillance, location tracking and other secondary purposes. As detailed below, we found no indications that personal information was used or disclosed by CATSA or VIA Rail, or collected and used by Transport Canada, for purposes other than enforcing and supervising the enforcement of the Orders, in compliance with sections 4, 7 and 8 of the Act.

Use and Disclosure by VIA Rail and CATSA

34. With respect to the use of information by CATSA and VIA Rail, section 7 of the Act states that personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except (a) for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose; or (b) for a purpose for which the information may be disclosed to the institution under subsection 8(2).
35. The two institutions confirmed that they did not use any of the personal information collected for any purpose other than to (i) determine eligibility for exceptions in accordance with the Orders (e.g., on the basis of religious grounds or for urgent travel), (ii) to allow or deny entry/boarding, or (iii) to respond to related complaints about these decisions. The first two uses are directly provided for in the relevant Orders, while the third, in our view, constitutes a ‘consistent use’ with the original purpose of collection as it is so directly connected that an individual would reasonably expect it.^{Footnote 18} Therefore, the uses described above are all compliant with section 7 of the Act.
36. We also examined disclosures by VIA Rail and CATSA. Section 8 of the Act sets limits on permissible disclosures of personal information without consent of the individual. One of the permissible disclosures, under paragraph 8(2)(b) of the Act, is a disclosure made for any purpose in accordance with any Act of Parliament or any regulation made thereunder that authorizes its disclosure.
37. VIA Rail disclosed information to Transport Canada on a weekly basis as required by Section G (formerly Section E) of the Rail Orders, which required the following figures to be submitted:
    • total passenger volumes;
    • the number of exception requests received and accepted for each category of exception;
    • the number of persons denied boarding due to failing to provide an acceptable PVC or due to rejected exception requests; and
    • the number of acceptable and unacceptable COVID-19 test results received.
38. During the investigation, our Office confirmed that VIA Rail’s weekly reports did not contain any personal identifiers and that there was no indication of a serious possibility of identification of individuals.
39. If CATSA denied entry to a traveller for failing to provide a valid PVC, CATSACATSA disclosed the individual’s personal information to Transport Canada and to the airline with which the traveller was scheduled to fly. These disclosures were expressly required under section 31 of the Air Orders (formerly sections 17.14 and 17.16). The Air Orders specified that the notifications to the Minister of Transport for each incident should include: (i) the person’s name and contact information; (ii) the date and number of the person’s flight; and (iii) the reason CATSA believed that the evidence was likely to be false or misleading, or the reason why the person was denied entry. The Air Orders also specified that the notifications to the traveller’s air carrier should include the individual’s name and flight number.
40. To comply with this requirement, CATSA disclosed the information it collected on its ‘Vaccination Check Failure Form’ (see paragraph 24) to: (i) the airline verbally, and (ii) Transport Canada, through both a phone call and an email notification.^{Footnote 19} From October 30^th, 2021 to December 9^th, 2021 (i.e., the period during which CATSA was required to verify the PVC of passengers), there were a total of 54 denials of entry related to PVC verifications at pre-board screening checkpoints. We found no indications that extraneous personal information had been included in these notifications by CATSA in the context of these disclosures. Given that the disclosures were authorized by the Air Orders issued under the Aeronautics Act, we therefore find that they were compliant with paragraph 8(2)(b) of the Act.^{Footnote 20}

Collection and Use by Transport Canada

41. In addition to collecting the information described above, Transport Canada also collected weekly aggregated reports from airlines subject to the Air Orders (similar to those it collected from VIA Rail), and individual personal information from airlines in cases where they denied a traveller boarding for failure to provide a valid PVC or had reason to believe the traveller had provided evidence that was likely to be false or misleading.
42. As noted above, section 4 of the Act requires that personal information collected be related directly to an operating program or activity of the institution. Given that for air travellers, Transport Canada did collect identifiable personal information, we examined whether this collection and subsequent use was compliant with sections 4 and 7 of the Act.
43. Transport Canada explained that it collected personal information to carry out its mandated activities of supervising and enforcing the requirements of the Air Orders. This activity is consistent with subsection 4.2(1) of the Aeronautics Act, which states that the Minister of Transport is responsible for the regulation of aeronautics, the supervision of all matters connected with aeronautics, and the investigation of matters relating to aviation safety.
44. Transport Canada indicated that, in addition to the incident reports from CATSA, it collected the following personal information from airlines (as set out in the Air Orders), in cases where airlines denied boarding for failure to provide a valid PVC or had reason to believe the evidence provided by the traveller was likely to be false or misleading:
    • the person’s name and contact information;
    • the date and number of the person’s flight;
    • the reason the air carrier believed that the evidence was likely to be false or misleading, or the reason why the person was denied permission to board the aircraft; and
    • whether the individual had been issued a document from the air carrier accepting their exception/accommodation request for that specific flight.
45. Transport Canada demonstrated that it used this information to enforce the Air Orders as per its mandate. Specifically, after being notified of an incident, it reviewed the notification to determine whether an investigation would be warranted. An investigation would normally involve: (i) contacting the air carrier/CATSA and the accused passenger to obtain more information about the alleged incident and (ii) determining the appropriate enforcement actions to be taken, if any. Investigations by Transport Canada have led to enforcement actions which have included, depending on the nature of the offence, verbal counselling, written warnings and the issuance of fines to individuals.^{Footnote 21} Our investigation found no indications that the personal information collected by Transport Canada has been used for purposes other than supervising and enforcing the Air Orders.
46. In light of the Minister of Transport’s statutory responsibilities and the Air Orders’ reporting requirements, our Office is of the opinion that the personal information collected by Transport Canada was directly related to an operating program/activity of the institution as required by section 4 of the Act: i.e., enforcing and supervising the Air Orders, and that its subsequent use for this purpose was compliant with section 7 of the Act.
47. Based on the above, VIA Rail and CATSA’s use and disclosures of personal information, and Transport Canada’s collection and use of personal information were thus compliant with sections 4, 7, and 8 of the Act, and we therefore find these elements of the complaints to be not well-founded.

Other: Was the information collected necessary and proportional?

48. Multiple complainants raised concerns over the necessity and the proportionality of the measures enacted by the Orders. Certain complainants expressed beliefs, based on a range of online sources, that COVID-19 vaccines were potentially dangerous or ineffective and/or that COVID-19 did not present a serious risk to health that would justify intrusions on their rights and freedoms.
49. Though not a requirement of the Act, necessity and proportionality is a privacy principle that our Office endorses and one that is embedded in the privacy laws of many jurisdictions, including several Canadian provinces. Limiting the collection of personal information to what is demonstrably necessary is also a requirement of Treasury Board Secretariat’s Directive on Privacy Practices.^{Footnote 22}
50. This principle is all the more important when institutions must respond quickly in times of crisis to implement measures that are intended to promote and protect public health, given the elevated potential for the measures to infringe on individuals’ privacy rights. Prior to the issuance of the Air and Rail Orders, our Office published a Framework for the Government of Canada to Assess Privacy-Impactful Initiatives in Response to COVID-19 in April of 2020 and the Federal, Provincial and Territorial Privacy Commissioners issued a joint statement in May of 2021 entitled, “Privacy and COVID-19 Vaccine Passports”. Both of these publications highlighted the importance of considering necessity and proportionality in the development of measures to address COVID-19, and that doing so would not be a barrier to effective public health management. Several complainants specifically asked our Office to consider whether institutions had complied with the public guidance promoted by our Office. Consideration of necessity and proportionality was also a key element of the advice we provided to Transport Canada when it consulted the OPC on the implementation of the vaccine mandates from August to October of 2021. Given its importance, we thus examined the necessity and proportionality of the collection of personal information mandated by the Orders.
51. Transport Canada was cooperative and forthcoming when asked to justify the necessity and proportionality of the mandates. In addition to their detailed responses, Transport Canada provided our Office with the scientific evidence considered prior to the issuance of the Orders.
52. Overall, we found that the collection of information pursuant to the Orders was necessary and proportional. However, as described in greater detail below, we identified concerns with (i) the broad scope of the Orders’ objectives, and (ii) the lack of evidence demonstrating that less privacy-invasive alternatives had been considered. Prior to the issuance of this final report, a preliminary report of findings was presented to Transport Canada, to which they responded with further comments and clarifications relating exclusively to our analysis of necessity and proportionality.
53. To guide institutions in considering necessity and proportionality, our Office advocates a four-part test^{Footnote 23} that calls for institutions to ask themselves the following questions when establishing particularly privacy-invasive programs and services:
    • Is the measure demonstrably necessary to meet a specific need?
    • Is it likely to be effective in meeting that need?
    • Is there a less privacy-intrusive way of achieving the same end?
    • Is the loss of privacy proportional to the need?

Necessity

54. With respect to the first point of the four-part test, necessity, we expect institutions to be able to explain, in detail, how a privacy-intrusive initiative is rationally connected to a defined, pressing and substantial goal, and how the proposed collection or use of personal information will serve to meet the goal. This requires empirical evidence in support of the initiative and should preclude the collection of personal information for speculative or “just in case” scenarios.
55. While our Office was able to identify a pressing and substantial goal based on Transport Canada’s representations, for the reasons detailed below, we found that Transport Canada did not adequately define the scope of ‘aviation safety’ and ‘safe railway operations’ as objectives. Consequently, when determining whether to continue applying the vaccine mandate, factors were considered that, in our view, go beyond the reasonable scope of aviation safety and safe railway operations.
56. In its representations to our Office, Transport Canada provided, as noted in paragraph 17, evidence that COVID-19 presented a serious risk to the health of individuals, and stated the following:

    “The primary mission of Transport Canada’s Rail and Air Orders is to ensure the safety and security of the transportation system and its operations. Recognizing that people travel for a range of essential and non-essential purposes and that transportation is an essential service, [Transport Canada]’s approach to the vaccination mandate was designed to meet multiple objectives, including but not limited to: safety for the transportation system as a whole; allowing for essential domestic and international travel; transportation of essential goods without disruption to supply chains; keeping exceptions to a minimum while allowing for accommodations for residents of remote communities and those travelling for specified essential or urgent reasons, such as to receive medical care or to respond to emergencies; being feasible for operators to implement while respecting privacy and other applicable legislation; and moving incrementally toward greater compatibility between the international and domestic travel regimes."

57. While the Ministerial Orders pursued multiple objectives, such as enabling essential travel and striving for operational feasibility, their primary goal of ensuring the safety and security of the transportation system was loosely defined.
58. Transport Canada initially told OPC that “In considering any adjustments to the Orders, various public health factors are considered, including but not limited to:
    1. “Epidemiologic trajectory and modelling (i.e. caseloads, hospitalizations and severe illness trends);
    2. Vaccine science (i.e. its effectiveness over time; if dosing regimen (e.g., booster doses) is still appropriate; and protection from infection and severity of illness);
    3. Vaccine coverage to support broader societal protection; and
    4. Impacts and prevalence of variants of concern or new variants.”
    In our view the first and fourth factors above are linked to ‘transportation safety’ regardless of how broadly the objective is scoped, as they speak to whether COVID-19 remained a sufficient risk to the health of travellers and to the health of the transportation workers. The second factor above is also linked to transportation safety, as it references both protection against transmission (which reduces the risk a vaccinated individual poses to others), and protection against severe disease (which reduces the risks posed to the vaccinated individual). Finally, the third factor is not clearly linked to transportation safety.
59. Based on these factors, we initially inferred that the scope of Transport Canada’s goal of ‘transportation safety’ included:
    1. reduce the risk the vaccinated individual posed to other travellers and to transportation workers (e.g., reducing likelihood individual will transmit COVID-19 to others);
    2. reduce the risks posed to the vaccinated individual (e.g., reducing likelihood individual will contract COVID-19 or suffer severe illness as a result of COVID-19); and
    3. reduce the risks to society as a whole (e.g., increasing vaccination coverage across Canada).
60. Objective c) (i.e., reducing the risks to society as a whole by increasing vaccine coverage) lacked a direct connection to transportation safety, the primary and overarching goal of the Ministerial Orders. In response to our preliminary report, Transport Canada indicated that the public health factors in paragraph 58 above were those that Public Health Agency of Canada (PHAC) considered in its advice to government departments, and which Transport Canada subsequently considered through a transportation safety and security lens. It indicated that reducing the risks to society as a whole “was a factor that PHAC provided for consideration” but that it should not be inferred that this specific factor was in the scope of Transport Canada’s goal.
61. However, the news release in August 2021 which announced the government’s intent to require vaccination for employees of the federal public service, federally regulated air, rail, and marine transportation sectors, and domestic travellers noted that increasing the vaccination coverage was an intended consequence:^{Footnote 24}

    “These measures will contribute to reaching the overall levels of vaccination Canada needs to sustain a resilient economic recovery in the face of more transmissible and dangerous COVID-19 variants of concern. More than 71% of eligible people in Canada are fully vaccinated, and more than 82% have had their first shot. However, more than 6 million eligible people in Canada are still unvaccinated. We are urging all of you to get out there and get vaccinated now. Doing so will help keep our communities safe.”

62. That aside, we find that objectives a) and b) can reasonably be considered within the scope of transportation safety, and the pressing nature of these goals were demonstrated due to the health risks posed by COVID-19.^{Footnote 25} Accordingly, the test of necessity was met, as the Orders were rationally connected to the pressing and substantial goal of protecting individuals from the risk that they might contract or transmit COVID-19 while traveling, or that they might suffer severe illness due to COVID-19.
63. The scope of transportation safety did not distinguish between what may be appropriate for the purposes of protecting individuals from the risks imposed on them by others, and the risks that they accept for themselves. For example, individuals were required to be vaccinated to protect other passengers (an objective which may justify greater restrictions), but also to protect themselves (an objective which may not warrant as significant restrictions, and which should leave greater deference for each individual’s personal risk tolerance).
64. Additionally, the broad framing of the objective may have led to the consideration of irrelevant and inappropriate factors, such as Canada’s vaccine coverage, in decisions which should have been limited to transportation safety. We therefore recommended that, in the future, if Transport Canada considers similar mandatory collections of personal information for the purpose of transportation safety, that it more clearly define: (i) the scope of the goal and (ii) the intended objectives/consequences of such measures.

Effectiveness

65. With respect to the second element of the four-part test, effectiveness, we considered whether the measures implemented under the Orders would be effective in meeting the specific needs identified above. Multiple complainants expressed beliefs that (i) COVID-19 vaccines were ineffective in protecting against COVID-19, particularly after Omicron variants became the dominant, and/or (ii) that vaccines were dangerous. Certain complainants based their views on various online sources. It is a reality of the COVID-19 pandemic that much information, but also misinformation, is publicly circulating. Individual reports and opinions, and preliminary, unverified, or misinterpreted data can create confusion. We therefore carefully reviewed the evidence Transport Canada considered to determine the effectiveness of collecting individuals’ vaccination status to protect travellers and transportation workers.
66. Transport Canada demonstrated that, prior to the issuance of the Orders, it relied on information from PHAC which included documented, peer reviewed studies, and data specific to the Canadian context, accompanied by evidence-based analysis by PHAC to interpret the information. This evidence concluded that:
    • For the Delta COVID-19 variants of concern circulating at the time, preliminary data indicated that two doses of a COVID-19 vaccine provided meaningful protection against contracting COVID-19 (in the range of 39 to 88%, with Canadian studies showing protection rates of 80% plus).^{Footnote 26} This was supported by evidence from PHAC’s COVID-19 testing of travellers entering Canada between July and October of 2021, which showed that unvaccinated travellers were at least five times more likely than vaccinated travellers to be infected with COVID-19.
    • For the Delta COVID-19 variant, vaccines provided even stronger protection (over 90%) against hospitalization and death from COVID-19.
    • COVID-19 vaccines approved for use in Canada present a very low risk of serious adverse health risks.^{Footnote 27}
67. The effectiveness of a measure can change over time – particularly in a rapidly changing epidemiological context. Transport Canada provided evidence that it continued to receive data on vaccine effectiveness while the Orders were in effect. This data demonstrated that, as Omicron became the dominant COVID-19 variant, protection offered by vaccines against infection^{Footnote 28} waned over time after a second dose. The complainants pointed to similar evidence, and argued that the vaccine mandates imposed by the Orders would thus fail to prevent travellers from contracting or transmitting the virus.
68. However, the evidence from multiple peer reviewed studies continued to show that vaccines provided meaningful protection against serious illness from the Omicron variant 6 months after vaccination (with most studies showing protection in the range of 70-90%). In other words, inoculation, despite providing a waning protection against infection over time, continued to protect travellers from the risks of serious illness if they became infected while aboard a plane or train.
69. We are therefore satisfied that there was evidence to suggest that collecting passengers’ vaccination status effectively reduced the risks posed to those individuals, one of the two implicit goals under the broad objective of transportation safety.

Less Privacy Intrusive Measures

70. With respect to the third element, whether less privacy-intrusive measures could achieve the same end, we considered whether Transport Canada considered alternatives to the collection of travellers’ vaccination status. This element required Transport Canada to demonstrate that less privacy-intrusive measures would not have been able to achieve its important objective of protecting railway and air transportation safety. In this respect, certain complainants questioned why demonstrating ‘natural immunity’ or a negative COVID test were not offered as alternatives to proof of vaccination.
71. Firstly, while Transport Canada shared reports which studied the shortcomings of natural immunity, they did not directly provide evidence that natural immunity was ever considered as an alternative to the collection of travellers’ vaccination status.
72. For example, in December of 2021, PHAC reported data suggesting that the Omicron variant appeared to be more likely to cause reinfection than previous variants.
73. In March of 2022, Transport Canada received a report from PHAC analysing studies into the protective effects of a previous COVID-19 infection. These studies concluded that a previous infection provides substantial protection from re-infections, though the protective effect is variable and dependent on factors such as the extent of symptoms, the time since infection, and the variant (e.g., Omicron is more likely to cause re-infections than earlier variants). This report highlighted, however, that a number of studies have shown the importance of three exposures to the antigen, whether by infection and/or vaccination, with some studies noting the importance of spacing the exposures. Some studies found that Omicron infections in individuals who were unvaccinated resulted in an immune response to Omicron, but not an immune response to other variants. As a result, the report concluded that vaccination remained an important protective measure, even for individuals with a previous infection.
74. Based on these reports, it was therefore not apparent that natural immunity provided an equivalent or comparable level of protection as vaccines.
75. In their review of mandatory vaccination policies for transportation workers, the Québec Superior Court considered whether natural immunity could be an alternative to mandatory vaccination. It ultimately determined that, based on the expert testimony and relevant studies, natural immunity provided a weaker protection compared to vaccines, particularly against Omicron and against serious illness.^{Footnote 29} Transport Canada advised our Office that, despite making minimal representations on this subject in the course of our investigation, they had assisted in preparing more fulsome arguments before the Court in this case’s proceedings.
76. Secondly, Transport Canada did not provide evidence that it considered retaining testing as an alternative to vaccination, beyond the initial one-month grace period following the issuance of the Orders, despite having access to data on this issue.
77. Transport Canada indicated to our Office that they considered the results of PHAC’s COVID-19 border testing data,^{Footnote 30} which appeared to suggest that testing could be a viable alternative for the purpose of reducing the risk of transmitting COVID-19 to other travellers or to transportation workers. As of April 1st, 2022, vaccinated travellers entering Canada were no longer required to provide a negative pre-arrival COVID-19 test on entry, though this requirement continued to apply to unvaccinated travellers. Post-entry, all unvaccinated travellers continued to be tested for COVID-19, with some vaccinated travellers being randomly tested as well. From this date forward PHAC told OPC that test positivity rates at land ports of entry were relatively similar between the two traveller groups and for travellers entering Canada by air, COVID-19 test positivity was consistently higher among fully vaccinated travellers than among tested, non-fully vaccinated travellers.
78. We acknowledge that testing as an alternative can reduce the risk of infecting other travellers or transportation workers (i.e., the risk an individual poses to others). However, given that testing does not reduce the risk of suffering severe illness (i.e., the risk posed to the individual), which we accept was one of Transport Canada’s implicit goals under the broad objective of transportation safety, we therefore acknowledge that this alternative would not have been as effective as the requirement to provide a proof of vaccination.
79. Nonetheless, we recommended that if Transport Canada considers similar mandatory collections for the purpose of ensuring transportation safety in the future, it specifically examine and document its assessment of potentially less privacy-invasive alternatives, such as testing.
80. In response to our preliminary findings, Transport Canada clarified that a number of less privacy invasive measures had been considered, though these deliberations were the subject of legal applications and actions challenging the Orders, and as a result, were not shared with our Office. Transport Canada had originally requested that our investigation be suspended pending the outcome of these court cases, though our Office denied this request.

Proportionality

81. With respect to the fourth part of the four-part test, whether the loss of privacy is proportional to the need, we had expected Transport Canada to demonstrate that they had analyzed whether the potential privacy impacts to travellers resulting from the collection of information relating to their COVID vaccination status were proportional to the benefits that would result from the collection.
82. The Orders only required the collection of limited information about an individual’s vaccination status, which in most cases, was not recorded or retained. Nevertheless, this still constituted medical information, which is inherently sensitive. This loss of privacy must be measured against the benefits of the Orders.
83. In this case, travel by train and plane requires close and prolonged indoor contact of all travellers, with the associated risks of contracting COVID-19 and potentially becoming seriously ill. In light of the benefits of the vaccine which were summarized in the ‘Effectiveness’ test, the requirement to provide a proof of vaccination credential thus brought meaningful benefits to the safety of travellers. Further, the Orders permitted individuals to travel without showing proof of vaccination in certain circumstances, including to accommodate religious beliefs and travel for medical/emergency purposes. Accordingly, we believe the benefits to travellers from the Orders’ measures were proportional to the loss of privacy they suffered when disclosing their vaccination status.

Recommendations

84. We recommended that if Transport Canada considers similar mandatory collections for the purpose of transportation safety in the future, that it (i) more clearly define the scope of the goal, and (ii) specifically examine and document its assessment of potentially less privacy-invasive alternatives. Transport Canada accepted our recommendations.

Conclusion

85. We conclude that the collections, uses and disclosures of personal information by VIA Rail, CATSA and Transport Canada under the Orders were done in compliance with the legal requirements of the Privacy Act. The complaints are therefore not well-founded.
86. While not a requirement under the Privacy Act, we observed that the collection of personal information undertaken by VIA Rail, CATSA and Transport Canada pursuant to the Orders was necessary and proportional. However, we also identified issues with (i) the scope of the objectives under the broad goal of transportation safety, (ii) the consideration of factors unrelated to transportation safety, and (iii) the limited information provided by Transport Canada with regard to its assessment of less privacy invasive alternatives.
87. We believe that this investigation highlights the need to better reflect the principle of necessity and proportionality in public sector privacy law, as the government advances their plans to modernize the Privacy Act in the near future.