Canada: COVID-19 Privacy FAQs: Answering The Questions You've Been Wondering About

The world has changed rapidly for many of us over the last few weeks. While we are all trying to stay healthy and flatten the curve, COVID-19 has also raised difficult privacy questions for governments, employers, landlords, and individuals.

This blog post aims to provide a brief answer to many of the questions that have been coming up frequently. If you have any other questions or want further information, please contact me.

Employment and Privacy

1. I'm an employer. Can I require my employees to tell me if they are sick or under quarantine? What can I tell my other employees?

Many of us are anxious to know if we have been in close contact with someone who has, or may have, COVID-19. At the same time, health information is highly sensitive, and so it must be collected and disclosed only with great care.

Given the public health emergency, requiring employees to tell you if they have been diagnosed with, or likely have, COVID-19 or are under quarantine is likely reasonable. However, you should not be requiring employees to report their health status in any more detail that is necessary. For instance, if you require all employees to take their temperature daily and report that to you, that may be going too far, depending on your industry.

Whether you can tell the rest of your employees depends on your company's situation and, in particular, whether the sick employee has been in close contact with any other employees.

Whatever you disclose should be limited to the minimum amount necessary to protect other employees from becoming infected.

If your employees have all been working remotely for the past month, there may be no risk that the sick employee has transmitted COVID-19 to any other employees. As a result, there is no reason to disclose the sick employee's health information.

If there is a risk of transmission, and unless the sick employee consents to the disclosure of their name, you should keep any disclosure vague enough that they cannot be identified. You should also disclose it only to individuals who may have been in close contact with the sick employee.

Exactly what that means for your business depends on the nature and size of your business, and how your employees share space or interact in your premises.

In a smaller business, that might mean only saying that an employee has or may have COVID-19. In a larger business, you may be able to identify the department or location where the person works.

Less is more in this situation. Do not provide any more information than is necessary, and tell only employees who might reasonably have come into contact with the sick or quarantined employee, or who otherwise need to know.

If there is a risk of transmission and the sick employee consents to the disclosure of their name, you can tell the rest of your employees that person's name and that they may have COVID-19.

2. My employer told me that one of my colleagues is sick, but won't tell me who. Why not?

Many of us are anxious to know if we have been in contact with someone who has, or may have, COVID-19. In a workplace where colleagues share common space and touch common surfaces such as elevator buttons, this concern is elevated.

However, employers are limited in what they can disclose to other employees. They can tell you that someone has, or may have, COVID-19 but they cannot give you information to identify the person (unless that person consents).

They can also only tell you that someone is sick if there is a risk of transmission to you. If you have been working remotely for the past month, there is no health reason for your employer to tell you that someone else is sick.

The reason for this is that health information is very sensitive, and privacy laws prevent employers from sharing any more information than is necessary. While it is important for other employees to know that there is someone sick in the office so that they can monitor themselves and take precautions, it is not necessary to know who is sick.

Videoconferencing for Work Purposes

3. Can I use videoconferencing programs such as Zoom to talk to my clients/employees? I have heard about privacy problems with them.

Privacy and security issues with Zoom have made headlines recently, highlighting that no technology is fully secure.

Any time an organization or public body is collecting, using or disclosing personal information, it is required to take steps to ensure that there are security measures in place that are appropriate for the sensitivity of the information.

What does that mean in this context?

The decision of whether to use a videoconferencing program (or any technology) and, if so, which one to use, depends on a number of factors. How sensitive is the information? What security measures are there? Does the program collect users' personal information?

For example, discussions about a client's financial situation require higher security than discussions about the best way to bake bread. Because of that, you should think about how and why you want to use videoconferencing, what benefit videoconferencing adds in comparison to a telephone call, and what information will be discussed.

Consider also whether your clients and employees will feel comfortable using videoconferencing, showing their images, and showing images of their homes.

Research the program you want to use (read their privacy policy, or do a web search for the product's  name and "security"), and find out what privacy safeguards are in place.

Then use those safeguards. For instance, with Zoom, make sure that the meeting has a password, and enable the waiting room feature. For any program, send the meeting information or link directly to the individuals attending the meeting. In particular, do not post the link on public forums.

Also check whether the program collects personal information from users, and if so, what it does with that information. Any free program likely collects information and sells it as a revenue stream, so consider paying for the upgrade.

4. My employer is using videoconferencing to do staff meetings, but I am not comfortable having my image or my home on video for everyone else to see. Do I have to use it?

From a privacy law standpoint, the answer is likely no, your employer cannot require you to show your image or an image of your home.

An image of you is personal information, and images of your home may also be. While there are some exceptions, generally speaking you cannot be required to share your image unless you agree to it. One exception would be if there is a legitimate employment purpose – that is, if there is a good reason why your employer wants to see everyone and not just hear them.

Some options you can consider include:

• Asking your employer if the meeting can take place by phone, or if you can phone in instead of using videoconferencing.
• Many videoconferencing programs have an option to turn off or not use the video, and use sound only instead.
• If your concern is about the image of your home rather than you, some videoconferencing programs (e.g. Zoom) have a virtual background option.

5. My employer wants employees to use videoconferencing to connect with clients, but I am not comfortable having my image or my home on video. Do I have to use it?

From a privacy law standpoint, the answer is likely no, your employer cannot require you to show your image or an image of your home.

An image of you is personal information, and images of your home may also be. While there are some exceptions, generally speaking you cannot be required to share your image unless you agree to it.

One exception would be if there is a legitimate employment purpose – that is, if there is a good reason why your employer wants to the client to see you. Whether this applies will depend on the nature of your work.

Some options you can consider include:

• Asking your employer if you can contact clients by phone instead.
• Many videoconferencing programs have an option to turn off or not use the video, and use sound only instead.
• If your concern is about the image of your home rather than you, some videoconferencing programs (e.g. Zoom) have a virtual background option.

Housing and Privacy

6. I'm a landlord/property manager/strata council member. Can I require my residents to tell me if they are sick? What can I tell my other residents?

Many of us are anxious to know if we have been in close contact with someone who has, or may have, COVID-19. At the same time, health information is highly sensitive, and so it must be collected and disclosed only with great care.

Landlords, property managers and strata councils generally cannot collect health information about residents, because typically it is not relevant to whether the individual will be a good tenant/resident. Similarly, they are typically not permitted to disclose any information they do receive to other tenants or residents.

Even in the current situation, you likely cannot require residents or tenants to tell you if they have, or may have, COVID-19.

If you become aware that a resident or tenant has, or may have, COVID-19, you should notify other residents of the same building but with as little information as possible. In particular, (unless the resident agrees to be identified) do not identify the sick tenant or resident by name, floor, unit number, or in any other way.

Keep in mind that less is more in this situation. Do not provide any more information than is necessary.

7. I live in a condo/apartment building. Why can't my strata council/property manager/landlord tell me if anyone in the building is sick, or tell me exactly who the sick person is?

Many of us are anxious to know if we have been in contact with someone who has, or may have, COVID-19. In a condo or apartment building where residents share common space and touch common surfaces such as elevator buttons, this concern is elevated.

However, strata councils, property managers, and landlords are limited in what they can require residents to tell them, and what they can disclose to other residents.

If a strata council, property manager or landlord finds out that a resident has, or may have, COVID-19, they can disclose that information but not any information which would identify the person. That means that (unless the sick person consents) they cannot tell you who it is, their floor, or their unit number.

The reason for this is that health information is very sensitive, and privacy laws prevent them from sharing any more information than is necessary. While it is important for other residents to know that there is someone sick in the building so that they can monitor themselves and take precautions, it is not necessary to know who is sick.

Tracking Apps and other Public Health Issues

8. Why won't Dr. Bonnie Henry tell us where the confirmed cases of COVID-19 are?

This has been a substantial issue, especially in smaller communities where people are concerned about limited health care resources. Dr. Henry even issued an opinion piece, published in a number of newspapers including the Vancouver Sun, detailing her medical reasoning.

There is also a privacy aspect to this. The Freedom of Information and Protection of Privacy Act applies to all public bodies in BC. Disclosure of personal information is limited under that act, and health information is considered very sensitive.

In particular, Dr. Henry can publically disclose only the amount of information that is necessary to manage the health risk. She cannot, for instance, disclose the names of the people who have tested positive.

If Dr. Henry, on a public broadcast, tells us exactly where the confirmed cases of COVID-19 are, there is a substantial risk that we will be able to identify who those individuals are. This risk is higher in smaller communities. She has therefore made the decision not to disclose where they live.

9. I have heard that other countries are requiring everyone to take their temperature before going into public buildings. Why isn't that happening in BC?

Since fever is one of the symptoms of COVID-19, some countries, such as Taiwan, are requiring everyone to have their temperature taken before going into buildings. Some businesses in BC, such as T&T Supermarkets, are starting to ask customers for a voluntary temperature reading.

In BC, businesses cannot take a customer's temperature without their consent. They also cannot require a temperature reading before allowing the customer into the business. As a result, this is very unlikely to happen on a widespread basis. Body temperature is a person's health information, which is considered to be highly sensitive. Taking a temperature reading is also a medical test which is still invasive even if it is a forehead reading.

Taking everyone's temperature involves collecting a very large amount of very sensitive information. For our privacy laws to allow that collection, it would have to be absolutely necessary. In this situation, it would be nice information to have, but does not appear to be absolutely necessary to limit the spread of COVID-19. As a result, it is unlikely that it will be collected.

10. I have heard about phone apps to track people who have COVID-19 or who are in quarantine. Why aren't those apps being used here?

Canada, and BC, have strong privacy legislation. Within that, both health information and information that can be used to track a person's whereabouts in real time are considered to be very sensitive. Our government is also only allowed to collect, use or disclose information if it is necessary.

The phone apps that have been in the news collect, use and disclose both of these types of information. With such widespread and sensitive collection, the information would have to be absolutely necessary for our government to be allowed to use it. In this situation, our public health officials have been able to track people using other methods, so it is not necessary.

It is also worth noting that Singapore, for instance, amended its privacy legislation after the MERS virus broke our there to specifically allow tracing and tracking apps.

11. I have heard about phone apps that will notify you if you currently or were previously in close physical proximity to someone confirmed to have COVID-19. Why aren't those apps being used here?

Canada, and BC, have strong privacy legislation. Within that, health information, information about where a person has been, and information that can be used to track a person's whereabouts in real time are all considered to be very sensitive. Our government is also only allowed to collect, use or disclose information if it is necessary.

The phone apps that have been in the news not only use that sensitive information, but disclose it to anyone who happens to be near the sick person. For that to be permitted under our privacy laws, it would have to be considered necessary to limit the spread of COVID-19.

There are many other ways to limit the spread of COVID-19, and so we are not likely to see those apps here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.