Border Security: Privacy Commissioner Tables Special Report Regarding ArriveCAN App

On March 12, 2026 the Information and Privacy Commissioner of Canada (OPC) tabled a Special Report in Parliament concerning the ArriveCAN app (the Report). The Report follows an OPC investigation into the Canadian Border Services Agency’s (CBSA) contracting practices during the development of the app.

The ArriveCAN app was developed in 2020 in response to the COVID-19 pandemic to digitize the collection of traveller information and streamline the processing of travellers at the border. Due to internal constraints, the CBSA relied extensively on external contractors for the delivery of the ArriveCAN program, including the development and ongoing maintenance of the app.

The OPC launched its investigation in March 2024, following a complaint alleging that CBSA contractors may have had access to, or had the potential to access, travellers’ personal information without the necessary security clearances (in contravention of sections 7 and 8 of the Privacy Act).

The OPC ultimately found no evidence that the CBSA had contravened the Privacy Act and was satisfied that the CBSA’s contracts included appropriate clauses and safeguards to ensure the protection of personal information. However, the investigation identified certain deficiencies and instances where the CBSA exposed itself to increased privacy risks. For example, the OPC found that the CBSA had authorized access to the ArriveCAN production environment for a contractor with a lapsed security clearance, and, in some cases, granted contractors access to personal information that was not required for the performance of their work duties.

As a result, the OPC recommended that the CBSA: 

1.  Ensure that security requirements are rigorously and accurately assessed within a reasonable time prior to contract award;
2. Clearly and accurately describe the projects or work to be performed under task authorizations;
3. Proactively manage security clearances and renewal processes with rigour and strong oversight; and
4. Restrict system permissions and access to what is strictly necessary.

The CBSA agreed with the OPC’s recommendations and reaffirmed its commitment to upholding the highest standards of accountability, transparency and the protection of personal information. The OPC noted that the findings from this investigation are an opportunity to raise the awareness of all government institutions and improve privacy practices in the context of contracting.

The full text of the Special Report can be found here.

Summary By: Claire Bettio