Fridays with Rogers Partners

At our weekly meeting, Emmanuel Couture-Tremblay discussed the recent decision of the Ontario Superior Court in Hawke v. Western University, 2022 ONSC 5243.

Overview

This case involved a complaint regarding the collection of private health information by Western University pursuant to its COVID-19 Vaccination Policy published August 22, 2022.

Background

Effective August 22, 2022, the updated Western University COVID-19 Vaccination Policy required that students and employees be fully vaccinated and boosted, and to provide proof of vaccination. The applicants are students at Western University enrolled in the 2022-2023 academic year.

The applicants claimed that revealing their personal medical information to the university goes counter to s. 38(2) of the Freedom of Information and Protection of Privacy Act (“FIPPA”), which states that “No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity”.

The test for interpretating s. 38(2) of FIPPA stems from Cash Converters Canada Inc. v. Oshawa (City), 2007 ONCA 502: 

First, the court must identify the “lawfully authorized activity” in question. Second, the court must determine whether the collection of personal information in question is necessary to that lawfully authorized activity.

Issues

1. Whether Western can demonstrate that its collection of proof of vaccine in the enforcement of its COVID-19 Vaccination Policy complies with s. 38(2) of FIPPA.
2. Whether the university’s collection of proof of vaccine is necessary to the proper administration of a lawfully authorized activity by the university.

Court’s Analysis

1.         What is the “lawfully authorized activity” for which Western is collecting proof of vaccine?

A plain reading of s. 18 of the Western University Act demonstrates that Western is expressly and broadly empowered to manage its affairs. Additionally, s. 19(k) provides that the university may establish and enforce regulations for the use of, inter alia, the orderly conduct of persons entering upon the lands and premises of the university.

In Canadian Federation of Students v. Ontario (Colleges and Universities), 2021 ONCA 553, the court emphasized that Ontario universities have the authority to manage their own affairs. The Western University Act further establishes the university as an independent, autonomous, self-governing institution that is empowered to oversee its administrative and academic affairs.

The right to privacy of personal information is quasi-constitutional, therefore exceptions to privacy rights should be interpreted narrowly. However, s. 38(2) of FIPPA makes it plain that the institution does not have to demonstrate that the lawfully authorized activity itself is “necessary”. Rather, it is the collection of personal information in connection with the lawfully authorized activity that must be shown to be “necessary”. 

Based on the broad wording of Western’s enabling statute, and the process that Western followed in sharing its COVID-19 Vaccination Policy, the court found that the university demonstrated that the Policy is a “lawfully authorized activity”. The activity is the Policy, and the collection of proof of vaccine is how the vaccination policy is implemented. 

In University of Guelph (Re), 2022 CanLII 25559 (ON IPC), the Information and Privacy Commissioner of Ontario (“IPC”) considered a challenge to the University of Guelph’s vaccine mandate and the collection of proof of vaccination. The IPC was satisfied that the university’s powers to manage its affairs satisfied the “lawfully authorized activity” requirement within the meaning of s. 38(2) of FIPPA.

In conclusion, the court found that the Policy was a “lawfully authorized activity” pursuant to s. 38(2) of FIPPA.

2.         Is the collection of Proof of Vaccine “necessary” to the proper administration of the “lawfully authorized activity”?

The necessity requirement in s. 38(2) requires the institution to show that every item of personal information collected is necessary to properly administer the lawfully authorized activity.

In University of Guelph (Re), the IPC accepted that the collection of the vaccination information was necessary as a part of the university’s ongoing health and safety efforts to protect its students. The IPC noted that “the university could only ensure that students living in the residences (or on campus), were fully vaccinated against COVID-19 by collecting the vaccination information”.

Western’s explanation that the proof of vaccination is necessary to the university’s decision-making was also accepted by the court. This was the only way Western could make informed and evidence-based decisions regarding its in-person operations.

The Chief Medical Officer of Health for Ontario (“CMHO”) expressly supported post-secondary institutions that decide to continue with COVID-19 vaccination policies as part of overall ongoing health and safety requirements for their institutions. The decision in Costa, Love, Badowich and Mandekic v. Seneca College of Applied Arts and Technology, 2022 ONSC 5111 supports the conclusion that Western’s Policy is justified in part due to the statement of the CMHO.

In conclusion, Western demonstrated that the proof of vaccine requirement was necessary for the proper administration of the Policy.

3.         What is the appropriate remedy in the circumstances?

The applicants sought declaratory and permanent injunctive relief restraining Western from collecting or storing any personal information in respect of the COVID-19 vaccine.

The court found that both the declaratory and permanent injunctive reliefs sought were overbroad and could not be granted. While the court claimed that it otherwise could have been persuaded to issue declaratory relief, it stated that the injunctive relief sought was not supported by any evidence.

Conclusion

The application was dismissed.

Takeaway

This decision provides guidance with respect to institutions validly collecting personal health information for public interest purposes. The collection of proof of vaccination was found to abide by FIPPA, as it is necessary to the proper administration of the lawfully authorized activity of post-secondary institutions.