The ArriveCAN app – used to screen travellers entering Canada for COVID-19 – is under investigation by Canada's Privacy Commissioner, according to a recent news report.
On July 28, Global News reported that the Office of the Privacy Commissioner of Canada confirmed in an email that it was investigating the ArriveCAN app following a complaint – although the Privacy Commissioner did not reveal who made the complaint or how long the investigation might take.
ArriveCAN was launched in April 2020 to pre-screen people travelling to Canada for COVID-19. The app has faced criticism for causing delays at the border and for a recent glitch that instructed users to quarantine – or face a potential $5,000 fine – even though they had no COVID symptoms.
The federal government recently signalled its intention to continue using ArriveCAN after the pandemic is over. In June, Public Safety Minister Marco Mendicino indicated ArriveCAN could be used for customs declarations in the future – an option already available at airports in Vancouver and Toronto.
Privacy Considerations for App Owners
While the details of this investigation are unknown, app owners should consider some key questions (detailed in a previous blog) to ensure they remain onside of applicable privacy laws:
- Is the data your app collects reasonable?
- Are you notifying users of why you're collecting data?
- Are you notifying users of offshore data service providers?
- Are you obtaining consent from users?
Recent Investigation Highlights Privacy Risks
A recent Privacy Commissioner investigation into a restaurant chain's mobile app highlighted the risks organizations face by collecting too much data from users.
In that case, the Privacy Commissioner accused the restaurant of spying on its customers and misleading them about the data it was collecting. An investigation concluded the app owner – which now faces multiple class action lawsuits for alleged privacy violations – did not have a robust privacy management program in place.
Is Your App Compliant?
We'll await further details of the Privacy Commissioner's investigation into ArriveCAN. In the meantime, this case highlights the importance of having a privacy management and compliance program in place to ensure your app doesn't run afoul of privacy laws.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
