Health Canada Defends ArriveCAN Privacy, Says Personal Info Isn't Shared 'Directly' With Foreign Entities

A smartphone set to the opening screen of the ArriveCan app is seen in a photo illustration made in Toronto on June 29, 2022. (The Canadian Press/Giordano Ciampini)

The personal information collected by ArriveCAN from travellers upon entry into Canada is not being shared “directly” with foreign entities, according to Health Canada, but rather displayed anonymously on the web.

The privacy notice of the ArriveCAN app, which the government says must be filled out in order to enter the country, currently makes no reference as to whether the information is shared directly or indirectly, and only states that the personal information may be disclosed to international organizations.

“Personal information may be disclosed to … international health organizations as well as their institutions for these purposes,” the notice says.

The Epoch Times contacted Health Canada to find out what personal information is shared and with which foreign entities.

“The Public Health Agency of Canada (PHAC) does not share any personal information directly with international organizations,” said spokesperson Anne Génier in an Aug. 10 email.

“PHAC posts information on aggregate test results (namely positivity rates) on the PHAC website. There is no personal information included and people are not identifiable in this published data.”

In a follow-up, The Epoch Times asked PHAC whether personal information is being shared indirectly with foreign entities.

Spokesperson Mark Johnson repeated in an Aug. 15 email that PHAC does not share personal information “directly” and that aggregate data with no identifiable personal information is posted to its website, which could be consulted by international health organizations.

When asked if PHAC intends to revise the privacy policy to remove the portion indicating personal information may be disclosed to foreign organizations, Johnson repeated that no personal information is shared “directly.”

“The privacy notice helps ensure the user understands how PHAC could handle their personal information. This includes notifying the user of any possible disclosures of their personal information to third parties,” he wrote, underlining “could” and “any possible disclosures.”

The issue of whether PHAC shares personal information indirectly with foreign entities appears unsettled, and it would seem the ArriveCAN privacy notice leaves the door open to sharing the information directly. The Office of the Privacy Commissioner (OPC) is currently investigating ArriveCAN after receiving a complaint.

“Our office has received and is currently investigating a complaint that raises concerns with respect to the collection of personal information through ArriveCAN and subsequent use of that information,” says an OPC statement reported by Global News in late July.

When contacted for comment, the OPC said it would not provide further details.

The government says using ArriveCAN, whether through a smartphone app or the website, is mandatory to enter Canada. Travellers must identify their travel plans, vaccination status, and quarantine plan accordingly.

Civil Disobedience

The ArriveCAN system has been under fire from a range of sectors, including politicians and industry, due to privacy concerns and its alleged negative impact on tourism.

A glitch with the application previously led to over 10,000 vaccinated travellers being told to quarantine.

There are also documented cases on social media of civil disobedience at the border, with travellers refusing to use ArriveCAN and dodging PHAC quarantine officers who are authorized to hand out hefty fines for non-compliance.

Some Canadians have planned protest actions where they deliberately cross the U.S. border and come back shortly thereafter to challenge the system.

Others coming back from trips to the United States simply tell border officers they chose not to use ArriveCAN while refusing to disclose any personal health information, including vaccination status or COVID-19 test results.

In some cases, after being processed for the usual customs issues, the Canada Border Services Agency (CBSA) officer then tells the traveller to talk to a PHAC officer.

At this point, the traveller may ask “Do I have to” or “Am I being detained?” to which CBSA officers have been shown to reply in the negative and the traveller is then able to proceed.

On one occasion documented on Twitter, a border guard told a man and a woman who refused to use ArriveCAN or disclose their vaccination status that the CBSA would contact PHAC.

“We will be contacting public health and telling them you wouldn’t divulge your vaccination status and you didn’t do ArriveCAN. There is consequences potentially for that,” said the officer in the video uploaded on Aug. 7.

The penalty is a $5,000 fine plus surcharges and 14 days of quarantine.

No details were available on whether the two were subsequently contacted by PHAC.