ArriveCAN App Investigation Report Tabled in Parliament

News release

Privacy Commissioner of Canada tables in Parliament Special Report on ArriveCAN app investigation

March 12, 2026 – Gatineau, Quebec

A Special Report on the Privacy Commissioner of Canada’s investigation into the ArriveCAN application was tabled today in Parliament.

The investigation was launched following a complaint against the Canada Border Services Agency (CBSA) related to contracting practices during the development of the ArriveCAN app. The app was launched during the COVID-19 pandemic to digitize the collection of traveller information and expedite the processing of travellers at the border.

The investigation found no evidence to suggest that personal information collected through the ArriveCAN app was used or disclosed in contravention of the Privacy Act, which applies to the personal information handling practices of federal institutions.

The Office of the Privacy Commissioner of Canada (OPC) found that all ArriveCAN-related contracts that allowed access to personal information included appropriate clauses to describe the contract’s security requirements and outlined specific safeguards that should be implemented.

While no contraventions of the Act were identified, the investigation identified certain shortcomings. The Report of Findings highlighted steps that the OPC expects the CBSA to take when contractors perform work on its behalf. These are:

• Ensuring that security requirements are rigorously and accurately assessed and completed within a reasonable time prior to contract award;
• Ensuring that task descriptions in task authorizations clearly and accurately define the projects or work to be performed to ensure that privacy and security requirements specific to those tasks or projects are accurately identified and assessed;
• Proactively managing security clearances and renewal processes with rigour and strong oversight; and
• Restricting permissions and access to personal information to what is strictly necessary. The CBSA accepted the Commissioner’s recommendations and agreed with the overall objective of strengthening privacy and security practices within its contracting framework. The Agency also indicated that it remains committed to ensuring that its policies and procedures uphold the highest standards of accountability, transparency and the protection of personal information.

Quote

“This investigation highlights the importance of privacy as a core consideration when developing outsourcing contracts. The findings are an opportunity to raise the awareness for all federal institutions about best practices in contracting to ensure strong privacy protections for Canadians.”

Philippe Dufresne
Privacy Commissioner of Canada

Related link

• Investigation into the contracting practices of the Canada Border Services Agency related to the development of the ArriveCAN application

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca

Date modified:

2026-03-12