CIMM – Citizenship Biometrics Purge – March 3, 2022

Key Messages

• To protect the integrity of Canada’s immigration system, Immigration, Refugees and Citizenship Canada (IRCC) collects personal information from clients, including biometrics which includes fingerprints and a digital photograph.
• Due to a system issue, the fingerprints and photograph of some clients were not deleted when they became Canadian citizens, as is outlined in our retention schedule.
• The personal information was always properly protected and secured but was kept beyond the established retention date.
• The Department began deleting these fingerprints and formally notifying affected clients in March 2021. The fingerprints of the notified clients have now been deleted.
• IRCC has a plan to delete the photographs and is working diligently to confirm if the biometric information of any other clients has been retained past the established retention date.
• A small number of clients had limited personal information shared with Canadian law enforcement agencies when that agency performed fingerprint inquiries. IRCC is taking this situation very seriously and has both notified the impacted clients and contacted the Canadian law enforcement agencies to ensure that the personal information shared has since been deleted.

Supplementary Messages

• Due to a system issue, the notification system that triggers the deletion of fingerprints when a permanent resident becomes a Canadian citizen, was stopped. As a result of this issue the biometric records of roughly 22,000 Canadian citizens remained in the database past the time period when they should have been deleted.
• The technical solution that triggers the automatic deletion of fingerprints has been reinstated, and is monitored daily to ensure its ongoing proper functionality.
• During the system review, IRCC also identified clients whose biometric records are retained by the Royal Canadian Mounted Police (RCMP) in a legacy databank. These records were not fully transitioned to our new immigration case management system. The biometric records of some of these clients were retained too long due to the incomplete transition. IRCC is actively working to transition these records.
• IRCC engaged with the Office of the Privacy Commissioner (OPC) expeditiously when the breach was discovered and continues to consult with the OPC as we strengthen the verification and control measures in place to ensure that, moving forward, we do not retain the biometric information of Canadian citizens beyond the defined retention period.
• IRCC is improving the systems, guidance, and processes for the  management of client biometric information, and putting in place  strengthened management control and oversight.
• IRCC is taking this situation very seriously and has dedicated resources and senior level leadership to examine root causes of this breach and implement preventative measures.
• A small number of clients had limited personal information shared with Canadian law enforcement agencies when that agency performed fingerprint inquiries.
• IRCC has reached out to these clients individually to inform them that their fingerprints were matched against fingerprints that were collected by a Canadian law enforcement agency. Pursuant to that match, limited information (name, date of birth, immigration identification #) was shared with that Canadian law enforcement agency. In those cases, IRCC has also contacted the Canadian law enforcement agency to ensure that the personal information shared has been deleted.
• There is no reason to believe identity fraud or theft has occurred, as the information was always well protected, and was not publicly accessible. IRCC is committed to safeguarding clients’ personal information and ensuring that this information is properly managed and protected.