The Canada Border Services Agency failed to conduct reasonable searches for six ArriveCAN-related access requests because it did not search a Slack workspace before the workspace was permanently deleted, the federal information commissioner found. The May 28, 2026 report, Canada Border Services Agency (Re), 2026 OIC 46, called for stronger controls over collaboration tools, retention decisions and the access office’s knowledge of government records.
The systemic investigation reached a different conclusion about separate, widely reported allegations concerning a senior official’s email files. It found no evidence substantiating the alleged deliberate destruction and no basis to refer a possible offence under the Access to Information Act. The distinction is central: the report’s findings about Slack did not validate the separate allegation against the official.
The commissioner opened the investigation in February 2024, examining the completeness and timeliness of responses to ArriveCAN-related requests. The agency had received 189 such requests at the stage covered by the investigation. The report was not a procurement audit or a ruling that all 189 requests had been mishandled.
Slack records disappeared without an access review
The ArriveCAN team used Slack from 2020 to 2023 for work on the application’s development, testing and maintenance. The agency subsequently moved away from the platform and deleted the workspace without a documented review of its contents or consultation with its Access to Information and Privacy unit.
The access unit did not learn about the workspace until more than a year after its deletion. That prevented it from challenging whether program officials had supplied complete records when responding to requests. No backup of the deleted workspace remained available for the investigation.
The agency maintained that Slack held transitory material or duplicates of records saved in official systems. The commissioner found no documented guidance for the initial period of use and no evidence establishing how later guiding principles had been distributed, enforced or monitored. There was also no documented content review showing that information of business value had been preserved before deletion.
More fundamentally, classifying a record as transitory does not permit its destruction after an institution receives an access request to which it is responsive. The commissioner emphasized that the access obligation attaches to the records that exist, not only to records an institution would ordinarily retain permanently.
The agency conceded that Slack might have held information relevant to four requests for which it was not searched. The commissioner identified two additional requests concerning communications with external vendors and rejected the agency’s explanation for excluding Slack from those searches. Those six failures supported the well-founded complaint.
The report did not reconstruct the deleted workspace or determine the contents of every missing message. It also did not find that Slack had never been searched: a search undertaken for another request was considered reasonable. The central failure was the absence of reasonable searches for the six identified requests before the information became unavailable.
Separate email allegations were not substantiated
The commissioner separately traced the corruption of a senior official’s locally stored email files after he received a replacement laptop because of a battery problem. The official had sought technical help before being tasked with the relevant access request, and there were repeated efforts to recover the files.
The investigation identified recovery shortcomings, including an old laptop that was later erased through ordinary processes, but found the official had taken reasonable steps. Additional responsive records were ultimately located elsewhere and provided to the requester, who confirmed satisfaction with that disclosure.
The commissioner found no evidence warranting referral of a possible records-destruction offence and concluded that the right of access had not been impeded in that matter. That conclusion was distinct from the governance failures surrounding Slack.
Other search complaints also required individual assessment. Five investigations led the agency to retrieve additional records and correct deficiencies before those investigations concluded. The commissioner did not treat those different errors as proof that every ArriveCAN search was systemically defective.
Late responses still breached the statutory timelines
The investigation examined 20 delay and extension complaints arising from the ArriveCAN requests. All involved responses outside the Act’s time limits. Two required orders to respond; the agency answered the others before an order became necessary.
For the 2024–25 fiscal year, the agency reported an average response time of 224 calendar days for ArriveCAN requests, compared with 101 days for other corporate-record requests excluding immigration information. The commissioner accepted that the ArriveCAN files were generally larger and more complex, so the averages were not a simple like-for-like comparison.
Work preparing information for parliamentary committees also affected some employees’ ability to retrieve records. A separate 2024 server disruption interfered with access processing across the agency, not just ArriveCAN files. The commissioner found reasonable recovery efforts and no unique timeliness concern specific to ArriveCAN, but stressed that those explanations did not legally justify missing the statutory deadlines.
Recommendations target records governance
The commissioner recommended formal rules for third-party collaboration tools, preservation of information of business value in official systems, and consultation with access officials before deletion. The recommendations also called for documented retention decisions and approvals, controls on non-government email accounts, less reliance on local email storage, audits, training and a stronger access-office role in testing the completeness of responses.
The agency’s president notified the commissioner on April 30 that the recommendations would be implemented. Its response described corrective work and future implementation plans. Acceptance of the recommendations is not proof that every measure has since been completed.
The final report made systemic recommendations rather than imposing a new monetary penalty or deciding criminal liability. Its broader lesson is operational: adopting a new communications platform does not move government records outside access law, and the office responsible for answering requests must know where those records are kept before they disappear.
