Saskatoon Library Collected Employee COVID Info Without Legal Authority: Privacy Commissioner

A health care worker prepares a dose of the Pfizer-BioNTech COVID-19 vaccine at a UHN COVID-19 vaccine clinic in Toronto on Jan. 7, 2021. Nathan Denette/The Canadian Press

The Saskatchewan privacy commissioner has ruled that the Saskatoon Public Library (SPL) violated the Privacy Act by forcing employees to share their COVID-19 test results and personal medical data, even after the province lifted mandates. The commissioner additionally found the library used the information in violation of the Privacy Act.

“The Saskatoon Public Library did not have legislative authority to collect the Covid-19 test results,” Commissioner Ronald Kruzeniski said in an investigation report dated Jan. 16 and obtained by Blacklock’s Reporter.

The library sent an email to an employee on March 11, 2022, stating that employees who had not provided proof of full vaccination or a valid exemption must submit COVID rapid antigen test results every 72 hours.

The emergency legislation that had allowed employers to demand COVID vaccination proof or force employees to submit to regular testing was repealed the previous month, on Feb. 14, 2022.

One employee raised objections and on April 6, 2022, submitted a complaint with the privacy commissioner regarding the policy, while also alleging that the library had shared the employee’s COVID test results with a manager and an employee who was not their supervisor or in their department.

The library sent an email to the employee saying it had a “policy that requires employees to submit COVID test certificates with negative results if they have not submitted proof of vaccination.”

The library said employees had to “submit test results. The policy is within our legal rights.”

The employee who filed the privacy complaint requested the library provide “the law or regulation that permits a person’s private information to be demanded by an employer.”

“You are expecting me to comply to an invasion of my privacy and are refusing to answer my questions to justify the invasion,” the employee said.

Shared Results

The employee also filed a related privacy complaint, alleging the library was forwarding test results to managers and the “testing facility” as well as once sharing a test result “with a person who was not their supervisor nor even within their department.”

The privacy commissioner initiated an investigation on July 14, 2022. In his decision, Kruzeniski determined that COVID test results “indicate an individual’s health history” and as such “qualify as personal information” under the legislation.