CIMM - Visa Application Centres - Mar 10, 2021

Key Messages

• Protecting the personal information and privacy of applicants is paramount in all that the Department of Immigration, Refugees and Citizenship Canada does.
• IRCC operates in a complex international environment in multiple countries.
• The Department uses visa application centres to provide administrative support and biometric collection services in the local language to applicants.
• VACs do not play a role in the decision-making process and are expressly forbidden to provide any visa-related advice to applicants. All decision-making is done by highly trained IRCC officers.
• The Government of Canada performed its due diligence in vetting the contractor “VFS Global” during the procurement of the VAC contract.
• PSPC’s Contract Security Program, in partnership with IRCC, engaged lead Canadian security agencies to inform the measures required. Their advice formed part of the assessment and informed which risk mitigation strategies should be considered as the global VACs were launched.
• Conscious of the risk profiles of operating in different countries, given local and regional realities, established Government of Canada risk mitigation protocols were followed.
• Safeguards governing the protection of personal information, such as encryption, are built into the terms of the contract. For security reasons, measures cannot be disclosed.
• The Government of Canada requires that all VAC employees, (including subcontractor employees) who have access to personal information obtain a security screening equivalent to Canadian Reliability Screening level.
• PSPC ensures that this security verification is completed for each VAC employee as per the provisions of the contract. This is an ongoing activity.
• All immigration information gathered at VACs is transmitted directly to Canada. This is a one-way process and operates similar to a client-facing web page.
• No immigration data is retained at the VACs and the information is stored in Canada.
• Canadian officials closely monitor the activities of VACs around the world to ensure that privacy standards are met as per Canadian laws.

Supplementary Messages

Visa application centres

• VACs were created to address problems of client access to application services due to high local volumes or geographic accessibility issues.
• VACs were also introduced to enhance safety at Migration Offices abroad by reducing volumes of applicants waiting in line.
• The more opportunities the Department offers clients through direct digital application channels, the more empowered clients are to manage the security of their personal information.
• There will, however, always be a need for VACs to provide administrative assistance to clients and to provide support to the application process in the local language.

Subcontracting

• VFS Global is permitted to subcontract VAC services to other companies who meet the security screening requirements set out by the Government of Canada.
• Foreign companies operating in China are required to partner with a local Chinese company. 
• Similar to Canada, many likeminded countries, Five Eyes allies, use both VFS Global and the same subcontractors in China.

VAC monitoring and oversight

• Canada ensures oversight of VAC contractors through audits and site reviews conducted by Canadian officials.
• As a condition of the Contract, VFS must ensure that privacy and security aspects of the contract are observed in all their respective subcontracting arrangements.  
• VFS Global has been compliant with its security requirements pursuant to its contract with Canada.
• The Department is not in possession of evidence to support that a subsidiary of a Chinese state-owned enterprise exerts control or influence over VFS Global.
• IRCC is unaware of instances where data in possession of VFS Global was disclosed or shared with third party or state-owned organizations.
• The possibility remains that an individual with a malicious intent could seek to access and disclose information to a third party. Many controls are applied to mitigate these risks.

Personnel screening

• Canada requires that all VAC employees, who have or could have access to personal information, complete a security screening process to the Canadian equivalency of a Reliability Screening level. This also applies to subcontractor employees.
• Employees who are not security screened and may have to enter a zone of the VAC that contains personal information are accompanied at all times by someone who is security screened.

Data security measures in place at VACs

• All electronic information is encrypted and securely sent electronically directly to IRCC systems and purged from the VAC in accordance with Canada’s privacy requirements.
• Any other personal information collected by the VAC (e.g.: name and phone number) must be erased or destroyed (purged) within 30 calendar days after services rendered to the applicant are complete.
• VAC systems cannot retrieve information from Canadian systems. 
• Video Monitoring cameras, provided by Canada, record each biometric enrollment at the VAC to ensure compliance with procedures and to prevent fraud. 
• Communications Security Establishment (CSE) monitors cyber threats or potential cyber threats from outside the Government of Canada [Redacted].

VAC contract renewal

• In June 2020, the process for the next VAC contract was launched with the posting of a Letter of Interest on the Government of Canada BuyandSell site. 
• The first Request for Information (RFI) is ongoing.
• Early engagement will allow Canada to identify complexities and risks and to develop mitigation strategies for an evolving international world.

Supporting Facts and Figures

China and Hong Kong

• IRCC has Migration Offices in 3 cities in mainland China (Beijing, Shanghai, Guangzhou) and 1 in Hong Kong.
• VFS Global operates 11 VACs for Canada in mainland China and 1 in Hong Kong.

General

• IRCC has Migration Offices in 59 countries across the world, and 163 VACs in 108 countries.
• VFS Global is the official Canadian VAC Contractor for 126 VACs in 82 countries.
• TT Services is the official VAC contractor for 37 VACs in 26 countries.
• TT Services has subcontracted all VAC services to VFS Global.
• As of March, 2020, 94% of applicants have a VAC in their country of residence.
• In fiscal year 2019-2020, over 2 million clients enrolled their biometrics at a VAC. Close to 1.1 million clients submitted paper applications at a VAC. This represents 26% of the total application intake for that year.