ArriveCan probe finds no privacy breach but flags contractor clearance gaps
Privacy Commissioner Philippe Dufresne found no contravention of the Privacy Act in the development of the ArriveCan app, but identified shortcomings in how the Canada Border Services Agency vetted and managed contractors, according to a special report tabled in Parliament on March 12.
The report closes one thread of the long-running controversy over ArriveCan, the pandemic-era border app. It also sets out the regulator's expectations for any federal department that relies on outside contractors to build systems holding Canadians' personal information.
What the investigation found
The investigation followed a complaint about CBSA's contracting practices. The commissioner found no evidence that personal information collected through ArriveCan was used or disclosed in violation of the Privacy Act, and said that all contracts giving access to personal information included appropriate security clauses and safeguards, according to the Office of the Privacy Commissioner.
The office nonetheless flagged problems. Its findings include a contractor whose security clearance had lapsed being given access to the ArriveCan production environment, and cases in which contractors had access to personal information they did not need for their work.
Recommendations
The commissioner said the CBSA should:
- assess security requirements rigorously and finish them in reasonable time before a contract is awarded;
- describe the work in task authorizations clearly enough that privacy and security requirements can be identified for each task;
- manage security clearances and renewals proactively; and
- limit access to personal information to what is strictly necessary.
The CBSA accepted the recommendations and said it agrees with the goal of strengthening privacy and security in its contracting framework.
"This investigation highlights the importance of privacy as a core consideration when developing outsourcing contracts," Dufresne said in a statement.
Context
The report was tabled as a special report under the Privacy Act, which gives the commissioner limited ability to publish findings about federal institutions. Law360 Canada and Deeth Williams Wall both summarized the finding of no contravention.
For security teams, the findings are familiar: contractor accounts with more access than needed and clearances that expire without anyone noticing are common weaknesses in both government and private sector environments. Regular access reviews, tied to contract milestones and clearance expiry dates, are the standard control.
