COVID-19 designated quarantine facilities and privacy: Privacy compliance evaluation (August 2021)

Description of program

To reduce the spread of the COVID-19 virus, we introduced enhanced border measures under the Quarantine Act. As part of these measures, we collect contact information, travel details, vaccination information and test results from travellers before and after arriving at a Canadian border crossing. As well, travellers entering Canada must have a quarantine plan upon arrival.

Designated quarantine facilities (DQFs) are a last resort for travellers. From February 21, 2021 to September 30, 2022, travellers were sent to a DQF to quarantine if they couldn't show proof of a suitable quarantine plan.

DQFs provide travellers with:

• transportation
• meals
• incidentals
• cleaning and sanitation
• nursing services
• security services

Why a privacy compliance evaluation was completed

The previous Interim Directive on Privacy Impact Assessment allowed for a Privacy Compliance Evaluation (PCE) to be used for urgent COVID-19-related initiatives. This was in place of a full Privacy Impact Assessment (PIA). Privacy Management Division (PMD) has since been exempted from the current directive on PIA, and has therefore prepared a PCE for the use of DQFs. If this measure continues after the exemption expires, PMD will complete a PIA which will include this analysis.

More information

The PCE examined the collection, use, disclosure and retention of personal information for the use of DQFs. It recommended the following actions to reduce privacy risks:

• determine the purpose for collecting travellers' passport numbers
• assess third party contractors' data management plans
• assess third party contractors' processes for the collection, use and retention of travellers' personal information
• determine the authority for the collection of some elements of personal information from the Canada Border Services Agency
• determine the requirement to review legacy information systems for privacy and security requirements
• undertake a security assessment of the use of WhatsApp

We're putting measures in place to address these compliance issues.