In February 2024, the Information Commissioner initiated a systemic investigation into the Canada Border Services Agency’s (CBSA) handling of access to information requests related to ArriveCAN. The investigation examined the completeness of responses provided to ArriveCAN-related access requests and whether the CBSA provided timely access to ArriveCAN information.

Publicly reported allegations suggested that a CBSA senior official permanently destroyed e-mails and other records that may have been relevant to access requests. The investigation found no evidence to substantiate these allegations.

The investigation did determine however that the ArriveCAN project team used the communication and collaboration platform Slack between 2020 and 2023 to communicate about the development, testing and maintenance of the ArriveCAN application. The Slack workspace was permanently deleted in May 2023 without consultation with the CBSA’s Access to Information and Privacy (ATIP) unit and without a documented review of its contents.

The complaint is well founded because the Commissioner found that the CBSA failed to conduct reasonable searches in response to six ArriveCAN-related access requests because Slack was not searched, despite the likelihood that it contained responsive records. The investigation also identified weaknesses in information management practices, including the use of non-government email accounts, reliance on informal storage practices and insufficient governance over third-party collaboration tools.

With respect to timeliness, the investigation confirmed that the CBSA failed to respond to a number of ArriveCAN-related requests within the legislated timelines. That said, the investigation did not identify any unique concerns related to the timeliness of the CBSA’s responses to access requests related to the ArriveCAN initiative.

The Commissioner made several recommendations which were all accepted by the CBSA who committed to implementing corrective measures, including new governance policies, enhanced training and improved information management controls.

In June 2026, the Commissioner tabled her Annual Report to Parliament which includes a special report on the investigation.