Canada’s immigration system has faced a serious setback after it was revealed that three government departments did not finish important privacy checks during a $68-million project to modernize the country’s asylum process. The project, known as the “asylum interoperability project,” was meant to make refugee claims faster and easier by moving them online. But lawyers now warn that skipping privacy rules may have put the personal details of thousands of refugee applicants at risk.
In 2019, Immigration, Refugees and Citizenship Canada (IRCC), the Canada Border Services Agency (CBSA), and the Immigration and Refugee Board (IRB) started working on the new digital asylum system. The goal was to reduce the growing backlog of claims, which has reached more than 290,000.
The system was supposed to replace slow paper applications with online tools, add automation, and improve data sharing between agencies. It also gave the government the power to automatically cancel work or study permits once a removal order was issued.
The project cost $68 million and was expected to make the asylum process more efficient. However, it was suddenly shut down in 2024, when only about 64 per cent of the work had been completed.
Every federal project that collects or shares people’s information must go through a Privacy Impact Assessment (PIA) before being launched. This assessment looks for possible risks and ensures proper protection of private data.
But documents show that no complete privacy assessment was ever finished for the asylum project. IRCC is still drafting its portion and says it won’t be done until the end of 2025. CBSA has decided it will no longer pursue one at all.
Lawyers say this is a major failure. Without proper assessments, the chance of private information being leaked or misused is much higher. Refugee and privacy lawyer Andrew Koltun called it a “red flag” and said the government rushed into digital modernization without protecting the people it was supposed to serve.
Internal notes suggest there was confusion over who should complete the privacy checks. At first, IRCC was supposed to lead one large assessment. Later, the plan changed, and each agency was told to do its own. Then the approach shifted again.
This back-and-forth created delays, and when the project was shut down, the privacy safeguards were still incomplete. Lawyers compared it to government agencies playing “hot potato” with responsibility.
The lack of strong privacy protections isn’t just a technical problem. Lawyers say mistakes have already harmed refugees.
For example, one lawyer described how immigration officials accidentally sent private documents to the wrong people, including family members in countries refugees were trying to escape. In one case, an applicant’s family in Iran was alerted to her claim for protection, putting her in great danger.
Lawyers say such breaches are “traumatizing” and show that the government has not taken privacy seriously enough.
IRCC says the project only changed how information was shared between departments and that safeguards were in place. It insists it is following federal rules, even though those rules require privacy checks to be completed before using new technology.
CBSA said it sees privacy assessments as important but believes IRCC is responsible. The IRB said it reviewed its own privacy systems and thought they were still good enough.
Experts disagree, saying these responses are not acceptable. Privacy checks are a basic requirement, and ignoring them puts trust and safety at risk.
Refugees are among the most vulnerable people, often fleeing violence or persecution. Protecting their personal information is critical. If data is mishandled, it could fall into the wrong hands and endanger lives.
Lawyers warn that focusing only on speed and efficiency without strong privacy safeguards is a dangerous path. They say governments should not treat refugee systems as experiments where mistakes can be “fixed later.”
The project has been cancelled, but the risks remain because parts of the new digital system were already put in place. Privacy experts say the government still needs to finish assessments and take stronger steps to protect sensitive data.
As Canada prepares for the future of its asylum system, the lessons from this project are clear: modernization cannot come at the cost of safety and trust.
A missile strike on an energy facility in Russia's Belgorod area raises alarms over security and inf
The US launched strikes on missile sites and Iranian vessels in southern Iran while peace negotiatio
Sheikh Mohamed bin Zayed's debt relief initiative grants AED 834 million to help 2,339 retirees acro
Andrei Svechnikov scored the overtime winner as the Carolina Hurricanes defeated the Montreal Canadi
