Question Period Note: VFS Global Issue

Ensuring the privacy of information at Canada’s Visa Application Centres (VFS Global Contract)

• We take the privacy of Canadians and our clients very seriously.
• We require that Visa Application Centres (VAC) handle information according to Canada’s privacy laws. No immigration data is stored at the VAC; the information is stored in Canada.
• The Government of Canada requires that all VAC employees, including subcontractor employees, who have access to Personal Information obtain a security screening equivalent to Canadian Reliability Screening level.
• IT safeguards, such as encryption, are built into the terms of the VAC contract to ensure that personal information is protected.
• VACs only provide administrative support and biometrics collection services to Immigration, Refugees and Citizenship Canada (IRCC) applicants. All visa processing and decision making is done by trained IRCC officers.
• Canada ensures stringent privacy standards are being met through audits and site reviews conducted by Canadian officials.
• We are committed to ensuring that the privacy of our clients remains protected.

If pressed on China law:
• There are risks to operating in any foreign environment, and we are soberly aware of the risks of operating in China.
• Foreign companies operating in China are required to partner with a local Chinese company.
• VFS Global is permitted to subcontract VAC services to other companies who meet the security screening requirements set out by the Government of Canada.
• Similar to Canada, many likeminded countries, Five Eyes allies, use both VFS Global and the same subcontractors in China.

If pressed on the breach:
• We take the privacy of Canadians and our clients very seriously.
• The breach that occurred in 2015 involved another VFS Global client government. Canadian clients and systems were not affected in any way.
• VFS Global is not required to notify Canada of any data breaches that occur at other client government VACs or on other client government systems.
• Safeguards governing the protection of personal information, such as encryption, are built into the terms of the contract.

On expanding the contract to include digitization of paper applications
• The Government is currently exploring a new application digitization platform that could further strengthen the security and privacy protections in the digital transfer of paper applications submitted at VACs.
• This platform would be required to meet stringent privacy standards in accordance with Canada’s privacy laws.

Visa Application Centres

VACs provide administrative support and biometric collection services in the local language to applicants before, during and after their application is assessed by an IRCC visa officer.
VACs do not represent the Government of Canada. They play no role in the decision-making process and are expressly forbidden to provide any visa-related advice to applicants.
VACs are run by private companies and are governed by a formal contract with the Government of Canada.

For a fee, VACs can:
• answer questions in local languages;
• transmit applications, supporting documents and passports to the IRCC office;
• track applications;
• return passports and decision documents to applicants; and
• collect biometrics (fingerprints and photograph).

For an additional fee, VACs offer other services, including making photocopies, assisted services for filling forms and self-service computers for those wishing to apply online. Value-added services may vary depending on the VAC locations.

None