COVID-19 border measures phase 4: Privacy compliance evaluation

Description of program

Due to the COVID-19 pandemic, we introduced enhanced border measures under the Quarantine Act to reduce the spread of the virus. They included collecting information from travellers entering Canada about their travel before, upon and after arrival at a port of entry (POE) into Canada. Travellers must provide the following information to a Canada Border Services Agency (CBSA) Border Services Officer (BSO):

• contact information
• quarantine plan
• symptom self-assessment

On January 29, 2021, and on February 9, 2021, we announced new accommodation and quarantine measures to further limit the spread of COVID-19 and its variants in Canada. Order in Council 2021-0075 (pursuant to s58 of the Quarantine Act) requires that every person who enters Canada:

• provide proof of a negative COVID-19 test result taken prior to arrival at the border
• take another test on arrival, and
• take a final test on day 8 of their quarantine

In addition, travellers arriving by air must reserve and stay at a government-approved accommodation for 3 days while they await the results of their arrival test.

Travellers are directed to a designated quarantine facility if they:

• refuse to be tested upon arrival
• show symptoms of COVID-19
• cannot show proof of a suitable quarantine plan

Why a privacy compliance evaluation was completed

As per the previous Interim Directive on Privacy Impact Assessment, deputy heads may use a privacy compliance evaluation (PCE) for urgent COVID-19-related initiatives in place of a full privacy impact assessment (PIA). Privacy Management Division (PMD) has since been exempted from the current directive on PIA, and is providing a privacy compliance evaluation (PCE) in its place. If the above initiative continues beyond the timeframe of the exemption, PMD will complete a PIA which will include this analysis.

More information

The privacy compliance evaluation examined the collection, use, disclosure and retention of personal information for the border measures that were introduced by the government in January and February, 2021. It recommended the following actions to reduce privacy risks:

• finalize the information-sharing agreement between the CBSA and the Public Health Agency of Canada (PHAC)
• analyze the relationship between PHAC and the Global Business Travel in terms of sharing travellers' personal information
• review and analyze available documentation related to the relationship between the government-approved accommodation and PHAC
• review and analyze the memorandum of understanding (MOU) between PHAC and Iron Mountain for privacy compliance risks, and
• update the relevant personal information bank (PIB) (Quarantine Program PIB PHAC PPU 071)

Health Canada and PHAC are putting measures in place to address the identified compliance issues.