CIMM - Visa Application Centres - June 2, 2021

Key messages

• Protecting the personal information and privacy of applicants is paramount in all that Immigration, Refugees and Citizenship Canada (IRCC) does.
• IRCC operates in a complex international environment in multiple countries.

Role of VACs:

• The Department uses Visa Application Centres (VACs) to provide administrative support and biometric collection services in the local language to applicants.
• VACs do not play a role in the decision-making process and are expressly forbidden to provide any visa-related advice to applicants. All decision-making is done by highly trained IRCC officers.

Security Vetting:

• The Government of Canada performed its due diligence in vetting the contractor “VFS Global” during the procurement of the VAC contract.
• Public Service and Procurement Canada (PSPC)’s Contract Security Program, in partnership with IRCC, engaged lead Canadian security agencies to inform the measures required. Their advice formed part of the assessment and informed which risk mitigation strategies should be considered as the global VACs were launched.
• We followed established Government of Canada risk mitigation protocols, while being conscious of the risk profiles of operating in different countries, given local and regional realities, established Government of Canada risk mitigation protocols were followed.
• Safeguards governing the protection of personal information, such as encryption, are built into the terms of the contract. For security reasons, measures cannot be disclosed.
• The Government of Canada requires that all VAC employees, (including subcontractor employees) who have access to personal information obtain a security screening equivalent to Canadian Reliability Screening level.
• PSPC ensures that this security verification is completed for each VAC employee as per the provisions of the contract. This is an ongoing activity.

Privacy Protections:

• All immigration information gathered at VACs is transmitted directly to Canada. This is a one-way process and operates similar to a client-facing web page. No immigration data is retained at the VACs and the information is stored in Canada.
• Canadian officials closely monitor the activities of VACs around the world to ensure that privacy standards are met as per Canadian laws.
• Canada ensures oversight of VAC contractors through audits and site reviews conducted by Canadian officials at each VAC location.
• Twenty-three (23) site visits were conducted across the VAC network between April 1, 2020 and May 17, 2021, of which four were in Mainland China. Eleven (11) site visits are scheduled for late May 2021, of which one is scheduled for Mainland China. The total number of site visits conducted in fiscal year (FY) 2020-2021 is lower than usual due to temporary VAC closures and travel restrictions in light of the COVID-19 pandemic. The Department is scheduling more site visits for FY 2021-2022.

Supplementary messages

Visa application centres

• VACs were created to address problems of client access to application services due to high local volumes or geographic accessibility issues, and to enhance safety at migration offices abroad by reducing volumes of applicants waiting in line.
• There will always be a need for VACs to provide administrative assistance to clients and to provide support to the application process in the local language.

Subcontracting

• VFS Global is permitted to subcontract VAC services to other companies who meet the security screening requirements set out by the Government of Canada.
• Foreign companies operating in China are required to partner with a local Chinese company.
• Similar to Canada, many like-minded countries use both VFS Global and the same subcontractors in China.

VAC monitoring and oversight

• As a condition of the contract, VFS must ensure that privacy and security aspects of the contract are observed in all their respective subcontracting arrangements.
• VFS Global has been compliant with its security requirements pursuant to its contract with Canada.
• The Department is not in possession of evidence to support that a subsidiary of a Chinese state-owned enterprise exerts control or influence over VFS Global.
• IRCC is unaware of instances where data in possession of VFS Global was disclosed or shared with third party or state-owned organizations.
• The possibility remains that an individual with a malicious intent could seek to access and disclose information to a third party, however, many controls are applied to mitigate these risks.
• Risk profiles for operations in different countries change over time resulting in the continual evaluation and calibration of security postures.
• The Government of Canada will continue to improve and implement measures to enhance security requirements based on international context.
• In preparation for the next VAC Contract, Canada is engaging Canadian Security Agencies and continues to enhance security requirements through the use of more targeted tools to identify of potential threats.

Data security measures in place at VACs

• All electronic information is encrypted and securely sent electronically directly to IRCC systems and purged from the VAC in accordance with Canada’s privacy requirements.
• Any other personal information collected by the VAC (e.g.: name and phone number) must be erased or destroyed (purged) within 30 calendar days after services rendered to the applicant are complete.
• VAC systems cannot retrieve information from Canadian systems.
• Video-monitoring cameras, provided by Canada, record each biometric enrollment at the VAC to ensure compliance with procedures and to prevent fraud.
• Communications Security Establishment (CSE) monitors cyber threats or potential cyber threats from outside the Government of Canada [Redacted].

VAC contract renewal

• In June 2020, the process for the next VAC contract was launched with the posting of a Letter of Interest on the Government of Canada BuyandSell site.
• The first Request for Information (RFI) is ongoing.
• Early engagement will allow Canada to identify complexities and risks and to develop mitigation strategies for an evolving international world.

Supporting facts and figures

China and Hong Kong

• IRCC has migration offices in 3 cities in mainland China (Beijing, Shanghai, Guangzhou) and 1 in Hong Kong.
• VFS Global operates 11 VACs for Canada in mainland China and 1 in Hong Kong.

General

• IRCC has Migration Offices in 59 countries across the world, and 164 VACs in 108 countries. 94% of applicants have a VAC in their country of residence.
• VFS Global is the official Canadian VAC Contractor for 127 VACs in 82 countries. TT Services is the official VAC contractor for 37 VACs in 26 countries. They have subcontracted all VAC services to VFS Global.
• In fiscal year 2019-2020, over 2 million clients enrolled their biometrics at a VAC. Close to 1.1 million clients submitted paper applications at a VAC. This represents 26% of the total application intake for that year.