Privacy Commissioner of Canada ArriveCAN App Investigation Report

Canada OPC News & Actions

Published March 12th, 2026

Detected March 13th, 2026

Summary

The Privacy Commissioner of Canada has tabled a special report on the ArriveCAN app investigation. While no contraventions of the Privacy Act were found, the report outlines steps the Canada Border Services Agency must take to strengthen privacy and security in its contracting framework.

View original document View source feed page

What changed

The Privacy Commissioner of Canada has released a special report following an investigation into the ArriveCAN app's development contracts. The investigation found no evidence that personal information collected via the app was misused or disclosed in violation of the Privacy Act. However, the report identified shortcomings in contracting practices and outlined specific recommendations for the Canada Border Services Agency (CBSA) to improve security assessments, task descriptions, and oversight of contractor access to personal information.

While the CBSA has accepted the Commissioner's recommendations and committed to upholding high standards for privacy protection, regulated entities, particularly federal institutions, should review their own contracting frameworks. The findings emphasize the importance of integrating privacy as a core consideration in outsourcing agreements and ensuring rigorous management of security requirements and contractor access to sensitive data to prevent future issues.

What to do next

Review contracting practices for federal institutions to ensure privacy and security requirements are rigorously assessed and managed.
Ensure task descriptions in contracts clearly define projects and associated privacy/security needs.
Implement strong oversight for security clearances and contractor access to personal information.

Source document (simplified)

News release

Privacy Commissioner of Canada tables in Parliament Special Report on ArriveCAN app investigation

March 12, 2026 – Gatineau, Quebec

A Special Report on the Privacy Commissioner of Canada’s investigation into the ArriveCAN application was tabled today in Parliament.

The investigation was launched following a complaint against the Canada Border Services Agency (CBSA) related to contracting practices during the development of the ArriveCAN app. The app was launched during the COVID-19 pandemic to digitize the collection of traveller information and expedite the processing of travellers at the border.

The investigation found no evidence to suggest that personal information collected through the ArriveCAN app was used or disclosed in contravention of the Privacy Act, which applies to the personal information handling practices of federal institutions.

The Office of the Privacy Commissioner of Canada (OPC) found that all ArriveCAN-related contracts that allowed access to personal information included appropriate clauses to describe the contract’s security requirements and outlined specific safeguards that should be implemented.

While no contraventions of the Act were identified, the investigation identified certain shortcomings. The Report of Findings highlighted steps that the OPC expects the CBSA to take when contractors perform work on its behalf. These are:

Ensuring that security requirements are rigorously and accurately assessed and completed within a reasonable time prior to contract award;
Ensuring that task descriptions in task authorizations clearly and accurately define the projects or work to be performed to ensure that privacy and security requirements specific to those tasks or projects are accurately identified and assessed;
Proactively managing security clearances and renewal processes with rigour and strong oversight; and
Restricting permissions and access to personal information to what is strictly necessary. The CBSA accepted the Commissioner’s recommendations and agreed with the overall objective of strengthening privacy and security practices within its contracting framework. The Agency also indicated that it remains committed to ensuring that its policies and procedures uphold the highest standards of accountability, transparency and the protection of personal information.

Quote

“This investigation highlights the importance of privacy as a core consideration when developing outsourcing contracts. The findings are an opportunity to raise the awareness for all federal institutions about best practices in contracting to ensure strong privacy protections for Canadians.”

Philippe Dufresne
Privacy Commissioner of Canada