Strata Corporations and Collection of Vaccination Status Information

The implementation of Vaccine Cards and proof of vaccination requirements to access certain events, services, and businesses in BC has raised questions for those living in strata properties. 

Many privacy-concerned residents are wondering whether their strata corporation has the authority to require them to provide proof of vaccination in order to use common facilities such as gyms, pools, and social rooms, and if so, how their privacy will be protected.

Without clear direction from the BC government, this can be a difficult topic for volunteer-run strata councils to navigate. 

A strata corporation may be able to impose vaccination requirements for common use facilities by passing a bylaw at a special general meeting or an annual general meeting at which the proposed bylaw receives a 3/4 majority vote. Strata corporations may also be able to implement a rule without the necessary requirements for passing a bylaw. 

Section 125 of the Strata Property Act, SBC 1998, c 43 allows strata corporations to make rules governing the “use, safety and condition of the common property and common assets”.  

If a strata corporation does decide to implement vaccination requirements, it means that the strata corporation will be collecting personal information of residents and is required to comply with BC’s privacy laws. 

Strata corporations are governed by the Personal Information Protection Act, SBC 2003, c 63 (“PIPA”). PIPA describes how corporations must handle personal information that they are collecting, using, and disclosing and allows for collection, use, and disclosure for reasonable purposes. Reasonable is defined by the context in which the information is collected and will vary in different situations. It is important that strata corporations clearly and specifically identify the reason that they are collecting personal information. 

Generally, PIPA requires that strata corporations: get consent from residents to collect information; have a reasonable purpose for collecting, using, and disclosing information; inform residents of that purpose; have adequate security in place to protect information; appoint someone to be accountable for PIPA compliance; and destroy information when it is no longer needed for its purpose. 

In the context of requiring proof of vaccination, strata corporations ought to be cautious about over-collection, disclosure and storage of information, and retention. The least amount of information collected to achieve the purpose is the best practice. For example, rather than collecting a copy of a resident’s proof of vaccination, a better option is keeping a list of resident’s names and placing a checkmark beside the names of residents who have shown their vaccination status to the strata member designated to ensure PIPA compliance. 

It will be important for strata corporations to consider who will have access to the collected vaccination information and limit the number of people to as few as possible to carry out the stated purpose. 

Storage of information is another key consideration. Strata corporations should consider where the information will be stored so it is protected from risks such as someone who is not supposed to see the information being able to see it, someone changing the information, or someone stealing or losing the information. Storing information in a locked filing cabinet that only designated people have access to is a good safeguard. 

Finally, strata corporations ought to consider how long they will need to retain the information and how they will dispose of it once it is no longer required for the purpose it was collected for. Strata corporations will have to grapple with when proof of vaccination will no longer be required. Once that day comes, the information collected must be destroyed or securely disposed of, for example, by shredding any documentation retained in the collection process. 

If you have any questions or need assistance in ensuring you are PIPA compliant, please reach out to Tiana Reid at [email protected]