COVID-19 Privacy FAQs: Answering the Questions You’ve Been Wondering About
This article was originally published on April 20, 2020, and updated on May 19, July 16, and August 10, 2020.
The world has changed rapidly for many of us over the last few weeks. While we are all trying to stay healthy and flatten the curve, COVID-19 has also raised difficult privacy questions for governments, employers, landlords, and individuals.
This blog post aims to provide a brief answer to many of the questions that have been coming up frequently.
Employment and Privacy
1. I’m an employer. Can I require my employees to tell me if they are sick or under quarantine? What can I tell my other employees?
Many of us are anxious to know if we have been in close contact with someone who has, or may have, COVID-19. At the same time, health information is highly sensitive, and so it must be collected and disclosed only with great care.
Given the public health emergency, requiring employees to tell you if they have been diagnosed with, or likely have, COVID-19 or are under quarantine is likely reasonable. However, you should not be requiring employees to report their health status in any more detail than necessary. For instance, if you require all employees to take their temperature daily and report that to you, that may be going too far, depending on your industry.
Whether you can tell the rest of your employees depends on your company’s situation and, in particular, whether the sick employee has been in close contact with any other employees.
Whatever you disclose should be limited to the minimum amount necessary to protect other employees from becoming infected.
If your employees have all been working remotely for the past month, there may be no risk that the sick employee has transmitted COVID-19 to any other employees. As a result, there is no reason to disclose the sick employee’s health information.
If there is a risk of transmission, and unless the sick employee consents to the disclosure of their name, you should keep any disclosure vague enough that they cannot be identified. You should also disclose it only to individuals who may have been in close contact with the sick employee.
Exactly what that means for your business depends on the nature and size of your business, and how your employees share space or interact in your premises.
In a smaller business, that might mean only saying that an employee has or may have COVID-19. In a larger business, you may be able to identify the department or location where the person works.
Less is more in this situation. Do not provide any more information than is necessary, and tell only employees who might reasonably have come into contact with the sick or quarantined employee, or who otherwise need to know.
If there is a risk of transmission and the sick employee consents to the disclosure of their name, you can tell the rest of your employees that person’s name and that they may have COVID-19.
2. My employer told me that one of my colleagues is sick, but won’t tell me who. Why not?
Many of us are anxious to know if we have been in contact with someone who has, or may have, COVID-19. In a workplace where colleagues share common space and touch common surfaces such as elevator buttons, this concern is elevated.
However, employers are limited in what they can disclose to other employees. They can tell you that someone has, or may have, COVID-19 but they cannot give you information to identify the person (unless that person consents).
They can also only tell you that someone is sick if there is a risk of transmission to you. If you have been working remotely for the past month, there is no health reason for your employer to tell you that someone else is sick.
The reason for this is that health information is very sensitive, and privacy laws prevent employers from sharing any more information than is necessary. While it is important for other employees to know that there is someone sick in the office so that they can monitor themselves and take precautions, it is not necessary to know who is sick.
Videoconferencing for Work Purposes
3. Can I use videoconferencing programs such as Zoom to talk to my clients/employees? I have heard about privacy problems with them.
Privacy and security issues with Zoom have made headlines recently, highlighting that no technology is fully secure.
Any time an organization or public body is collecting, using or disclosing personal information, it is required to take steps to ensure that there are security measures in place that are appropriate for the sensitivity of the information.
What does that mean in this context?
The decision of whether to use a videoconferencing program (or any technology) and, if so, which one to use, depends on a number of factors. How sensitive is the information? What security measures are there? Does the program collect users’ personal information?
For example, discussions about a client’s financial situation require higher security than discussions about the best way to bake bread. Because of that, you should think about how and why you want to use videoconferencing, what benefit videoconferencing adds in comparison to a telephone call, and what information will be discussed.
Consider also whether your clients and employees will feel comfortable using videoconferencing, showing their images, and showing images of their homes.
Research the program you want to use (read their privacy policy, or do a web search for the product’s name and “security”), and find out what privacy safeguards are in place.
Then use those safeguards. For instance, with Zoom, make sure that the meeting has a password, and enable the waiting room feature. For any program, send the meeting information or link directly to the individuals attending the meeting. In particular, do not post the link on public forums.
Also check whether the program collects personal information from users, and if so, what it does with that information. Any free program likely collects information and sells it as a revenue stream, so consider paying for the upgrade.
4. My employer is using videoconferencing to do staff meetings, but I am not comfortable having my image or my home on video for everyone else to see. Do I have to use it?
From a privacy law standpoint, the answer is likely no, your employer cannot require you to show your image or an image of your home.
An image of you is personal information, and images of your home may also be. While there are some exceptions, generally speaking you cannot be required to share your image unless you agree to it. One exception would be if there is a legitimate employment purpose – that is, if there is a good reason why your employer wants to see everyone and not just hear them.
Some options you can consider include:
- Asking your employer if the meeting can take place by phone, or if you can phone in instead of using videoconferencing.
- Many videoconferencing programs have an option to turn off or not use the video, and use sound only instead.
- If your concern is about the image of your home rather than you, some videoconferencing programs (e.g. Zoom) have a virtual background option.
5. My employer wants employees to use videoconferencing to connect with clients, but I am not comfortable having my image or my home on video. Do I have to use it?
From a privacy law standpoint, the answer is likely no, your employer cannot require you to show your image or an image of your home.
An image of you is personal information, and images of your home may also be. While there are some exceptions, generally speaking you cannot be required to share your image unless you agree to it.
One exception would be if there is a legitimate employment purpose – that is, if there is a good reason why your employer wants the client to see you. Whether this applies will depend on the nature of your work.
Some options you can consider include:
- Asking your employer if you can contact clients by phone instead.
- Many videoconferencing programs have an option to turn off or not use the video, and use sound only instead.
- If your concern is about the image of your home rather than you, some videoconferencing programs (e.g. Zoom) have a virtual background option.
Housing and Privacy
6. I’m a landlord/property manager/strata council member. Can I require my residents to tell me if they are sick? What can I tell my other residents?
Many of us are anxious to know if we have been in close contact with someone who has, or may have, COVID-19. At the same time, health information is highly sensitive, and so it must be collected and disclosed only with great care.
Landlords, property managers and strata councils generally cannot collect health information about residents, because typically it is not relevant to whether the individual will be a good tenant/resident. Similarly, they are typically not permitted to disclose any information they do receive to other tenants or residents.
Even in the current situation, you likely cannot require residents or tenants to tell you if they have, or may have, COVID-19.
If you become aware that a resident or tenant has, or may have, COVID-19, you should notify other residents of the same building but with as little information as possible. In particular, (unless the resident agrees to be identified) do not identify the sick tenant or resident by name, floor, unit number, or in any other way.
Keep in mind that less is more in this situation. Do not provide any more information than is necessary.
7. I live in a condo/apartment building. Why can’t my strata council/property manager/landlord tell me if anyone in the building is sick, or tell me exactly who the sick person is?
Many of us are anxious to know if we have been in contact with someone who has, or may have, COVID-19. In a condo or apartment building where residents share common space and touch common surfaces such as elevator buttons, this concern is elevated.
However, strata councils, property managers, and landlords are limited in what they can require residents to tell them, and what they can disclose to other residents.
If a strata council, property manager or landlord finds out that a resident has, or may have, COVID-19, they can disclose that information but not any information which would identify the person. That means that (unless the sick person consents) they cannot tell you who it is, their floor, or their unit number.
The reason for this is that health information is very sensitive, and privacy laws prevent them from sharing any more information than is necessary. While it is important for other residents to know that there is someone sick in the building so that they can monitor themselves and take precautions, it is not necessary to know who is sick.
Tracking Apps and other Public Health Issues
8. Why won’t Dr. Bonnie Henry tell us where the confirmed cases of COVID-19 are?
This has been a substantial issue, especially in smaller communities where people are concerned about limited health care resources. Dr. Henry even issued an opinion piece, published in a number of newspapers including the Vancouver Sun, detailing her medical reasoning.
There is also a privacy aspect to this. The Freedom of Information and Protection of Privacy Act applies to all public bodies in BC. Disclosure of personal information is limited under that act, and health information is considered very sensitive.
In particular, Dr. Henry can publicly disclose only the amount of information that is necessary to manage the health risk. She cannot, for instance, disclose the names of the people who have tested positive.
If Dr. Henry, on a public broadcast, tells us exactly where the confirmed cases of COVID-19 are, there is a substantial risk that we will be able to identify who those individuals are. This risk is higher in smaller communities. She has therefore made the decision not to disclose where they live.
9. Why are so many businesses requiring customers to do a temperature reading before allowing them in, and can they really do that?
Since having a fever is one of the symptoms of COVID-19, temperature checks started earlier in other countries like Taiwan as a way to screen people. Some businesses here in Vancouver, such as T&T Supermarket, started them as early as April.
As BC started reopening in May, more businesses here have started doing temperature checks with a no-touch handheld device pointed at the forehead before allowing people entrance into their business spaces. However, in our province, businesses cannot take a customer’s temperature without their consent. They also cannot require a temperature reading before allowing the customer in. Body temperature is a person’s health information, which is considered to be highly sensitive. Taking a temperature reading is also a medical test which is still invasive even if only a forehead reading.
Taking everyone’s temperature involves collecting a large amount of very sensitive information. For our privacy laws to allow that collection, it would have to be absolutely necessary. As it currently stands, the medical evidence is that temperature screening may not be effective, because many people may have mild symptoms or be asymptomatic.
As a result, businesses should not be requiring temperature checks of everyone.
If you refuse to allow a temperature check, the business should let you in. However, many businesses likely do not know about these privacy obligations so you may be refused entry anyway.
10. I have heard about phone apps to track people who have COVID-19 or who are in quarantine. Why aren’t those apps being used here?
This is an issue which has been rapidly evolving, as public health authorities around the world work to find effective ways of controlling the spread of COVID-19.
The Canadian Government released an app, the COVID Alert app, on July 31, 2020. This app does not track the location of people who have COVID-19 or who are in quarantine, but, if you have it on your smartphone, it will notify you if within the last 14 days you have been close to someone who has tested positive.
Canada, and BC, have strong privacy legislation. Within that, both health information and information that can be used to track a person’s whereabouts in real time are considered to be very sensitive. Our government is also only allowed to collect, use or disclose information if it is necessary to achieve a particular purpose.
There have been many smartphone apps developed around the world since the start of the COVID-19 pandemic. Some track a person’s whereabouts, while others use “digital handshakes” to record that two smartphones have been close to each other. Some apps provide vast amounts of information to government officials or developers, while others keep the information on a user’s smartphone unless it is needed.
With such widespread and sensitive collection and the potential for disclosure to many government officials or private sector organizations, for a contact tracing app to be used here, there needs to be strong medical justification and collection of the least amount of personal information possible.
In May, the privacy commissioners across Canada released a joint statement about contact tracing apps, highlighting the substantial privacy risks associated with them and providing guidance on how they can be used while respecting privacy rights.
The apps that track the location people with COVID-19 or who are in quarantine collect a very large amount of very sensitive information, including the person’s location data, and provide it to government. Our public health officials have been able to manage people with COVID-19 or in quarantine without this data, so this app is not necessary. The Canadian government has developed the COVID Alert app instead.
11. I have heard about phone apps that will notify you if you currently or were previously in close physical proximity to someone confirmed to have COVID-19. Why aren’t those apps being used here?
This is an issue which has also been rapidly evolving, as public health authorities around the world work to find effective ways of controlling the spread of COVID-19.
Canada, and BC, have strong privacy legislation. Within that, health information, information about where a person has been, and information that can be used to track a person’s whereabouts in real time are all considered to be very sensitive. Our government is also only allowed to collect, use or disclose information if it is necessary to achieve a particular purpose.
In May 2020, the privacy commissioners across Canada released a joint statement about contact tracing apps, highlighting the substantial privacy risks associated with them and providing guidance on how they can be used while respecting privacy rights.
The Government of Canada paid attention to that joint statement, and developed the COVID Alert app in compliance with Canadian privacy legislation.
In short, the COVID Alert app is completely voluntary and does not collect or share any personal information. Instead, it generates random codes which are shared with other smartphones nearby. If someone is diagnosed with COVID-19, that person can start a process to notify other smartphones that have shared codes with it over the previous 14 days.
More information about the COVID Alert app is available here.
