The Saskatchewan privacy commissioner has ruled that the Saskatoon Public Library (SPL) violated the Privacy Act by forcing employees to share their COVID-19 test results and personal medical data, even after the province lifted mandates. The commissioner additionally found the library used the information in violation of the Privacy Act.
“The Saskatoon Public Library did not have legislative authority to collect the Covid-19 test results,” Commissioner Ronald Kruzeniski said in an investigation report dated Jan. 16 and obtained by Blacklock’s Reporter.
The library sent an email to an employee on March 11, 2022, stating that employees who had not provided proof of full vaccination or a valid exemption must submit COVID rapid antigen test results every 72 hours.
The emergency legislation that had allowed employers to demand COVID vaccination proof or force employees to submit to regular testing was repealed the previous month, on Feb. 14, 2022.
One employee raised objections and on April 6, 2022, submitted a complaint with the privacy commissioner regarding the policy, while also alleging that the library had shared the employee’s COVID test results with a manager and an employee who was not their supervisor or in their department.
The library sent an email to the employee saying it had a “policy that requires employees to submit COVID test certificates with negative results if they have not submitted proof of vaccination.”
The library said employees had to “submit test results. The policy is within our legal rights.”
The employee who filed the privacy complaint requested the library provide “the law or regulation that permits a person’s private information to be demanded by an employer.”
Shared Results
The employee also filed a related privacy complaint, alleging the library was forwarding test results to managers and the “testing facility” as well as once sharing a test result “with a person who was not their supervisor nor even within their department.”The privacy commissioner initiated an investigation on July 14, 2022. In his decision, Kruzeniski determined that COVID test results “indicate an individual’s health history” and as such “qualify as personal information” under the legislation.
The commissioner referenced a prior decision that stated, “whatever personal information a public body collects, it must be able to demonstrate that every data element in question is required to meet a legitimate business purpose and that there is legislative authority to collect each.”
Kruzeniski noted that the province specifically introduced legislation and emergency regulations on Oct. 1, 2021, which allowed employers to collect COVID test results, and stated once those regulations were rescinded, “there was no longer legislative authority for employers to collect COVID-19 test results.”
The library discontinued its COVID-19 policy by the end of May 2022, according to Kruzeniski. The commissioner said if the program had been ongoing, he would have “recommended that SPL discontinue” it.
The privacy commissioner recommended that the library search its IT systems and ensure the employee’s test results have been deleted or destroyed, and inform Kruzeniski of such within 30 days.
Spokesperson Kirk Sibbald told The Epoch Times that the library complied with the commissioner’s request and ensured the employee’s COVID test results had been “deleted/destroyed.”
According to Sibbald, “SPL also confirmed all employee testing and vaccination status information was removed from our system in June 2022.”
He added that during the time of the complaint, the library was operating under a “COVID Exposure Control Plan,” which was “designed to provide a safe working environment,” and “required mandatory employee masking, testing, and proof of vaccination.”
He said that the library’s COVID plan remained in place until March 31, 2022, due to the “high rate” of COVID in Saskatoon and the “high-risk environment” in the workplace.
