Three government entities collaborating on a $68 million initiative to modernize Canada’s asylum system neglected to conduct essential privacy assessments during the project implementation phase, as per CBC News findings. Legal experts are concerned about the absence of privacy safeguards potentially jeopardizing refugee applicants’ data and submissions.
The Immigration, Refugees and Citizenship Canada (IRCC), the Canada Border Services Agency (CBSA), and the Immigration and Refugee Board (IRB) jointly undertook the “asylum interoperability project” to digitize the asylum system for enhanced efficiency and to address the mounting backlog of over 290,000 pending asylum applications.
Despite the project’s launch in 2019, it was unexpectedly terminated in 2024. Access-to-information documents revealed incomplete privacy impact assessments (PIAs) for the project, which was abandoned when only 64% complete. PIAs are vital for identifying and mitigating potential privacy risks before project initiation, as outlined in the government’s digital privacy playbook.
Although the interoperability project was discontinued, it brought about digital data collection and usage alterations. Andrew Koltun, an immigration and refugee lawyer, emphasized the necessity of completing PIAs for risk identification even post-project termination.
The departments admitted via email that privacy assessments are unfinished. IRCC aims to conclude its PIA section by the end of 2025. Koltun expressed concerns over the ongoing incomplete assessments, citing increased data leakage risks without proper privacy evaluations.
The Privacy Commissioner of Canada views privacy assessments as crucial early warning mechanisms to ensure legal compliance and public trust in government agencies. Internal documents revealed confusion within the departments regarding PIA responsibilities, shifting from a joint assessment led by IRCC to individual partner assessments.
Koltun criticized the lack of completed PIAs, describing it as departments evading their privacy obligations. Greg Willoughby, a refugee lawyer, voiced privacy breach concerns affecting applicants, emphasizing the importance of stringent privacy safeguards in government initiatives.
IRCC maintained that information sharing practices remained unchanged, citing secure IT interfaces for data transmission. CBSA halted PIA pursuits, deferring to IRCC as the project lead. IRB asserted that existing PIAs adequately covered privacy concerns. However, Koltun deemed these responses inadequate, highlighting the legal duties under the federal directive for updated PIAs with new IT implementations.