Alberta's New Vaccine Card - What Businesses Can Do With It

Back in December, I wrote a post about an employer's right to require employees to get the vaccine.

This has been a hot issue for the last few months, and obviously the new one is 'proof' of vaccination.

Alberta is now issuing a printable conveniently-sized document with vaccination status. They're not calling it a vaccine passport, because, well, they said they wouldn't do vaccine passports, but there's also nothing prohibiting its use as proof of vaccination.

It's not perfect. It's not secure; there's no photo; there's no mechanism for those with legitimate medical exemptions to get a similar card authenticating that exemption. But it's something.

So let's talk about the framework, in a scenario where businesses might want to exclude unvaccinated persons, but are not necessarily legally required to do so.

General Liberty - A Broad Right Upon Business Owners

But let's start with a basic proposition: Subject to pre-existing contractual obligations, the owner of a business has broad rights to dictate who enters that business as an employee or customer. This freedom is subject only to very modest limitations, mostly in the form of anti-discrimination laws under human rights legislation: There are restrictions on the ability to discriminate on the basis of certain prohibited grounds (including, for the purpose of the present discussion, disability and religion), but any reason that's not discriminatory on the basis of prohibited grounds is fair game.

In other words: A business that's open to the public is not under any obligation to let ANY member of the public in. There's no freestanding right for people to enter any business that's generally open to the public.

(This is a really important part of the discourse right now, in part because we're talking about exclusions potentially applying to historically privileged groups, who have not been excluded before, but who are accustomed to being told that they can't turn away people because of their race, religion, sexual orientation, etc., so they have it in their head that there's some law that a business open to the public has to be open to EVERYONE...and that's simply not the case.)

Vaccination is not a protected ground under the Alberta Human Rights Act. It can indirectly engage protected grounds in some rare cases. I'll come to that below.

But the point is that there's no general prohibition on a business owner banning unvaccinated people: Excluding people who haven't gotten vaccinated because they don't trust the vaccine does not in any way violate their rights.

The next question is about privacy, and asking for proof.

Privacy Rights

Throughout Canada, most businesses have privacy obligations pertaining to collection and use of customer personal information. (In some cases, this extends to employee personal information, too.)

Some months ago, several Privacy Commissioners issued a joint statement suggesting caution in collecting vaccination status data. When Dwayne Chomyn and I appeared on Ryan Jespersen's show a couple months ago, Dwayne suggested that this position was likely borne of out-of-date or incorrect data, and I agree. (I don't agree with Dwayne on much. This says something.)

A business needs consent to collect or use such data, and where that consent is mandatory (in the sense that people will be turned away if they don't consent), there needs to be a reasonable basis for it.

But in the scheme of a pandemic, where an employer has established a policy that requires customers and staff to be vaccinated against COVID-19 before entering into an environment under the control of the employer where they will interact with other customers or staff...I expect that this will generally satisfy the generally low threshold for collection of personal information.

(If an online streaming service required my vaccination status to renew my subscription, that might put us into more questionable territory from a privacy perspective. But in any context goes where the person will be in the same physical environment as employees or customers, as far as I'm concerned it's well outside the mandate of a Privacy Commissioner to determine whether or not a business is entitled to enforce a vaccination policy.)

So while businesses should have privacy policies, and those privacy policies should expand to clarify that the collection and use of vaccination data is simply for the purposes of assessing eligibility to enter, and further clarifying retention (are you going to keep their vax data on file so you don't need to ask again? Or are you just going to check the card every time they enter?) and disclosure (you won't disclose it to third parties, except maybe to contact tracers and health authorities in the event of an outbreak, etc.), I don't generally expect most businesses to have a substantive privacy problem implementing a 'vaccine card' policy.

Duty to Accommodate

This is the genuine difficult part, because there are small numbers of people with legitimate religious and medical reasons not to vaccinate...and also because there are much larger numbers of people who will claim to be exempt, but who really just don't want to get the vaccine because they don't trust the science, or because they believe the whole thing is a conspiracy.

So how do you differentiate at the door to your business whether the unvaccinated person is an anti-vaxxer versus someone with a legitimate exemption?

This is why I've advocated for a vaccine passport infrastructure that includes an application process for exemptions, to get a card that'll say "I'm not vaccinated, but I'm entitled to reasonable accommodation up to the point of undue hardship." (Others, like Ontario lawyer Chris Ecclestone, argue that the passport shouldn't differentiate between 'vaccinated' or 'exempt' at all. I disagree, because I think there's value in that differentiation, but that's a relatively minor point.)

Medical Exemptions

To be clear, the people with genuine exemptions are few and far between.

A recent article in Forbes noted that there are no known definite contraindications with COVID vaccines, and even people with immunocompromising conditions like cancer are often advised to get the vaccine - noting that the bigger concern isn't so much that it will cause complications, but it may not generate a sufficient immune response to be effective.  There may be people in medical "gray areas" who might prudently be advised by medical practitioners not to complete a vaccination regime, but these are a "tiny fraction of a percent of the population".

In other words, while most people (myself included) have been talking about medical exemptions on the basis of an assumption that they exist, this assumption may not actually pan out scientifically. And to the extent that there may be people with legitimate medical exemptions...there aren't many.

(It likely helps that there are different options for the vaccine. I have a friend with a congenital blood clotting disorder, whose doctors directed him away from Astrazenica in an abundance of caution. So he got Moderna instead.)

Religious Exemptions

Likewise for religious exemptions. In the human rights field, we're not generally in the habit of trying to lift up the rug on claimed religious beliefs, because it's not a high threshold. So in Ontario, school vaccination requirements can generally be avoided with a generic declaration, with no verification process.

But there is a threshold, and the reality is that actual religious prohibitions on vaccines are very rare.

While there have historically been some Islamic denominations that discourage vaccination on the basis of concerns that they may contain non-halal animal byproducts (note that the COVID vaccines in Canada do not contain any animal products), the Dakar Declaration is broadly observed within the Islamic world (and particular within North American Islamic communities), that Islamic law recognizes the value of vaccination in general.

No Christian denominations have doctrinal objections to vaccination, and only a couple of denominations (Christian Scientists and Dutch Reformed) seem to have widespread congregational objections. Even Jehovah's Witnesses, who famously reject life-saving blood transplants, don't appear to object to vaccination.

The real challenge here, of course, is that freedom of religion isn't legally defined by church doctrine: Courts and tribunals aren't in the business of interpreting scripture: Faith is individual, and people are entitled to protection of their sincerely-held religious beliefs. So, in practice, the real question here is whether or not a person's objection to vaccination is rooted in such a sincerely-held religious belief.

We can safely say that the antivax movement generally does not garner the protection of freedom of religion: Objections to vaccines rooted in distrust of the medical community, in uncertainty as to the efficacy or safety of the vaccine, in a conspiracy theory that vaccines cause autism or that there's a microchip in it, or really in any pseudoscientific rationale at all, are not religious in nature.

But the hard part is that antivaxxers DO nonetheless claim religious objections. Last month, in consultations in Massachusetts over a bill relating to vaccine mandates in schools, a parent opposing it noted that she had claimed a religious exemption to the flu vaccine "[n]ot because it goes against my religion, but because I do not believe that it is necessary to put additional chemicals into my child's body for an illness that she would fully recover from. You are proposing to take away my right as a parent and for what? To protect other people?"

To be clear, in Canada (and likely in the US as well), that parent's insistence that her rights as a parent should allow her to determine whether or not her child has "additional chemicals" would not qualify as a legitimate religious belief.

Practical Options

So, in practice, if I operate a vax-only business and somebody shows up without a Vaccine Card and says "I have an exemption", what do I do about it? More to the point, what does my minimum wage front-line worker do about it?

For a person with whom the business expects to have some sort of ongoing relationship - like employees, tenants, banking customers, etc., there might be some prospect of developing an internal process to evaluate the bona fides of the exemption claim. But for businesses with strictly transactional relationships with their customers - retailers, restaurants, cinemas, etc. - that's completely implausible.

The way I see it, such a business usually has two choices: Accommodate them all...or don't accommodate any.

(1) Accommodate them. This is, of course, the cautious approach. Note that this does not necessarily require treating them exactly the same as you would a person with a full vaccination regimen, but can entail other restrictions: Depending on circumstances, a business might reasonably ask unvaccinated people to mask, might insist on them maintaining social distancing; might even limit the numbers of 'exempt' people in the facility.

This does, of course, blow a pretty big hole in any requirement for proof of vaccination, if there are unverifiable magic words you'll accept to get around it.

(2) Don't accommodate them. This is the higher risk approach, from a liability perspective.  This is the approach BC is taking with its new vaccine mandates, though, presumably having assessed that the harm to people with legitimate medical exemptions is justifiable given the objectives of the requirement. The considerations are slightly different with businesses, but fundamentally you're making a similar argument, that letting in any number of unvaccinated persons unduly increases the risk to the others present, so your reasonable risk mitigation measures don't allow for exceptions, even for people with legitimate reasons not to vaccinate.

Have to be honest, I'm uncomfortable with the impact this has on those few people with legitimate reasons not to vaccinate. If we were really able to sort those out from voluntary antivaxxers who are just...well...lying, I think that most environments would not significantly increase their risk by an accommodation approach.

But, practically speaking, if a person wants to take an employer to task and challenge the legitimacy of their decision not to accommodate, they'll need to satisfy an adjudicator of the bona fides of their religious exemption in the first place, and so the silver lining on the risk assessment for a business going down this road is that people with legitimate exemptions are so rare that most businesses in most communities are unlikely to face a legitimate discrimination claim. (Unfortunately, responding to an illegitimate claim is no walk in the park either, but I have every expectation that, if I were cross-examining an antivaxxer claiming a religious exemption, I'd be able to draw out the true non-religious nature of their objection.)

Why Bother?

Let's be clear that employers have legitimate reasons to implement vaccine requirements. This isn't virtue signalling, or simply a matter of being capricious toward antivaxxers. Employers have ongoing requirements to ensure a safe and healthy work environment, in addition to a range of other related duties to employees, customers, contractors, etc.

The pandemic is still going, and as I've been reiterating since June, just because the government removed its public health restrictions doesn't mean that employers can pretend that COVID is over.

Which isn't to say that a vaccine mandate is the only option for all businesses, but for many businesses it's certainly one of the more effective available options.

(Other options may include maximizing remote dealings with employees and customers - WFH, online ordering, curbside pickup - and reducing the number of people in the workplace; maintaining physical distance and barriers between people; workplace mask mandates, rapid testing, etc. There may be some combination of measures, including vaccination.)

So businesses shouldn't just look at the difficulty of establishing a meaningful vax requirement and say "Not worth it". It's worth considering, regardless of its challenges.

A Caution Against Forgery

I noted early that the Vaccine Card isn't a secure document. That being said, faking one is a criminal act.  Altering or fabricating a Vaccine Card, with the intention that somebody will accept it and act upon it as if authentic, falls within the forgery provisions of the Criminal Code and carries a penalty of up to 10 years in prison.

Using a false document - i.e. presenting a faked Vaccine Card to a business to gain access to that business - similarly carries a sentence of up to 10 years in prison.

Alternatively, using a real Vaccine Card that belongs to somebody else, pretending to be that person, very likely constitutes identity fraud, which, likewise, carries a sentence of up to 10 years in prison.

Now, before you say, "Yeah, but how are they going to know", pause for a second and think about it: You're presenting information that purports to be issued by the Province. The Province KNOWS whether or not you're vaccinated (or at least whether you could possible have an Alberta-issued Vaccine Card saying you are). There are a range of circumstances where the fact that you presented 'proof' of vaccination could end up getting lined up beside the fact that no such genuine proof exists, and once that connection is made, a criminal complaint is likely.

(While there are a lot of different hypotheticals where that information could theoretically come together in legal processes, I suspect the likeliest avenue is that you've been ranting online about why you're not vaccinated, and then somebody who knows you discovers that you went to business x, and hey, doesn't business x require proof of vaccination?)

So...just don't do it, okay?

Conclusions

Different businesses have different needs. For some, a vaccine mandate may not be appropriate at all. For others, they'll want a robust verification process for vaccination and accommodation claims.

Some businesses may want to check photo ID alongside the Vaccine Card because, well, no photo. Other businesses may want the card check to be expeditious, and rely more heavily on other risk mitigation techniques.

Some businesses may want to simply take people at their word for exemptions; others may feel that accommodation isn't appropriate at all in their circumstances.

At the end of the day, businesses have broad safety obligations, and sweeping rights in terms of how to meet them, but with a few pitfalls and policy issues to consider in getting there. Talking to a lawyer might provide some guidance in the specific needs of your business.

*****

Dennis Buchanan is a lawyer practicing labour and employment law and civil litigation in Edmonton, Alberta.

This post does not contain legal advice, but only general legal information.  It does not create a solicitor-client relationship with any readers.  If you have a legal issue or potential issue, please consult a lawyer.