Privacy Commissioner Investigating ArriveCAN App

The ArriveCAN app – used to screen travellers entering Canada for COVID-19 – is under investigation by Canada’s Privacy Commissioner, according to a recent news report.

On July 28, Global News reported that the Office of the Privacy Commissioner of Canada confirmed in an email that it was investigating the ArriveCAN app following a complaint – although the Privacy Commissioner did not reveal who made the complaint or how long the investigation might take.

ArriveCAN was launched in April 2020 to pre-screen people travelling to Canada for COVID-19. The app has faced criticism for causing delays at the border and for a recent glitch that instructed users to quarantine – or face a potential $5,000 fine – even though they had no COVID symptoms.

The federal government recently signalled its intention to continue using ArriveCAN after the pandemic is over. In June, Public Safety Minister Marco Mendicino indicated ArriveCAN could be used for customs declarations in the future – an option already available at airports in Vancouver and Toronto.

Privacy Considerations for App Owners

While the details of this investigation are unknown, app owners should consider some key questions (detailed in a previous blog) to ensure they remain onside of applicable privacy laws:

  1. Is the data your app collects reasonable?
  2. Are you notifying users of why you’re collecting data?
  3. Are you notifying users of offshore data service providers?
  4. Are you obtaining consent from users?

Recent Investigation Highlights Privacy Risks

A recent Privacy Commissioner investigation into a restaurant chain’s mobile app highlighted the risks organizations face by collecting too much data from users.

In that case, the Privacy Commissioner accused the restaurant of spying on its customers and misleading them about the data it was collecting. An investigation concluded the app owner – which now faces multiple class action lawsuits for alleged privacy violations – did not have a robust privacy management program in place.

Is Your App Compliant?

We’ll await further details of the Privacy Commissioner’s investigation into ArriveCAN. In the meantime, this case highlights the importance of having a privacy management and compliance program in place to ensure your app doesn’t run afoul of privacy laws.

The MLT Aikins Privacy, Data & Cybersecurity team has extensive experience developing robust privacy management programs and conducting privacy assessments for clients. If you’re planning to launch an app or want to ensure your existing app is compliant with applicable privacy laws, contact us to learn how we can help.

Note: This article is of a general nature only and is not exhaustive of all possible legal rights or remedies. In addition, laws may change over time and should be interpreted only in the context of particular circumstances such that these materials are not intended to be relied upon or taken as legal advice or opinion. Readers should consult a legal professional for specific advice in any particular situation.