Erroneous orders from the federal government’s ArriveCan app urging more than 10,000 Canadians to quarantine last year under threat of heavy fines was a violation of the Privacy Act, Privacy Commissioner Philippe Dufresne says.
The commissioner’s report, released Tuesday, follows an investigation into events beginning June 28, 2022, that saw about 10,200 Apple device users receive erroneous messages instructing them to quarantine or risk fines of as much as $5,000.
The automated messages were owing to a database error that mistakenly identified some fully vaccinated travellers as unvaccinated.
Mr. Dufresne said the Canada Border Services Agency (CBSA) failed to ensure that a decision of that magnitude was always overseen by a human public servant. The report also said the agency took too long to fix the problem.
The ArriveCan app was created in early 2020 as a way for travellers to upload mandatory health information on COVID-19, such as vaccination status, to present when crossing the border. The app is no longer mandatory as of Sept. 30, 2022, but remains a voluntary option.
The Globe and Mail reported in October, 2022, that the cost of building and maintaining the app was on pace to reach $54-million by March, 2023.
The government has responded to criticism of the app by pointing to the fact it required dozens of updates in order to keep pace with constantly changing health policies during the pandemic.
But the commissioner’s report says major issues with the app should have been resolved by the summer of 2022.
“In our view, a significant (and presumably elevated) number of individuals complaining that ArriveCan had told them to quarantine despite them being fully vaccinated should have raised flags and been resolved in a matter of days not weeks given the high adverse impact on affected individuals,” the report states. “Further, we emphasize that this incident happened more than two years after the beginning of the pandemic and the introduction of ArriveCan, and we would therefore expect a commensurate level of resourcing and maturation of incident response mechanisms.”
The report says the issues raised in the investigation “constitute a failure by CBSA to take all reasonable steps to ensure the accuracy of the information that it used in an administrative decision, and thereby contravene” the Privacy Act.
“We therefore find the complaint well-founded.”
According to the report, the agency responded by refusing to implement a recommendation to correct the erroneous information in its database. The report said the CBSA’s position is that such a step was not necessary because COVID-19 border measures have ended, the data are no longer used for any administrative purpose and will be automatically disposed of after two years.
However, the commissioner released an update Tuesday afternoon, saying that as of May 30, the agency has advised the commissioner that it has corrected the inaccurate personal information.
The investigation was launched in response to a complaint from Matt Malone, an assistant professor in the faculty of law at Thompson Rivers University.
Prof. Malone said Tuesday that the report vindicates his complaint that the government did not appropriately safeguard Canadians’ personal information as it relates to the ArriveCan app.
But he still took issue with the commissioner’s response and said the situation demonstrates why Canada urgently needs to update its privacy, artificial intelligence and data protection legislation and ensure that new laws apply to federal departments and agencies.
“The report does nothing more than give the government and the third parties who built the app a light slap on the wrist,” he said.
“The Privacy Commissioner moved far too slowly in conducting this investigation, especially given the immediate impact of the glitch on Canadians. The Privacy Commissioner has a culture of complacency of making fanfare announcements about investigations that take way too long to conduct. We need less words and more action. … ArriveCan shows why Canada’s proposed privacy and AI laws must apply to government.”
A spokesperson for the CBSA said the agency “respectfully disagrees” with the commissioner’s findings, as his office “did not sufficiently acknowledge the context of the emergency response in which the ArriveCan application was developed.”
The agency said it uses industry best practices when it comes to system and application testing and described its testing approach as comprehensive and based on continuous improvement.
Also Tuesday, a coalition of journalism and transparency advocates presented the 2023 Code of Silence Award to the CBSA, citing The Globe’s reporting on the ArriveCan app.
The tongue-in-cheek Code of Silence Award is presented annually by the Canadian Association of Journalists, the Centre for Free Expression at Toronto Metropolitan University and Canadian Journalists for Free Expression. The award criticizes government departments and agencies “that work hard to hide information to which the public has a right.”
Bill Curry