AI-Assisted Vaccination Proof Scanning at the Canadian Border

Border & Immigration · Safety & Security

What it collects that can identify you

Biometric

Identifiable data

Images of travellers' proof of vaccination documents containing personal health information. These documents include the traveller's name, date of birth, vaccine type, and vaccination dates — directly identifying the individual.

Sensitive personal information

Identifiable data

Vaccination status and related health information submitted by travellers via the ArriveCAN mobile app or web portal. Classified as Protected B by the Government of Canada.

Run by: Public Health Agency of Canada (PHAC)
Where: No fixed location
Kept: Retained Not specified in the AIA
Shared with: Accountable organization
Your copy: You cannot see the data it holds about you. What you can do

What it is for

Border & Immigration

Safety & Security

ArriveCAN uses Optical Character Recognition (OCR) to automatically read travellers' proof of vaccination documents when they cross into Canada. The system does not make binding entry decisions — a border services officer makes the final call. If the system cannot read a document, the officer inspects it manually.

What it collects and what happens to it

Data taken in

Biometric

Identifiable data

Images of travellers' proof of vaccination documents containing personal health information. These documents include the traveller's name, date of birth, vaccine type, and vaccination dates — directly identifying the individual.

Sensitive personal information

Identifiable data

Vaccination status and related health information submitted by travellers via the ArriveCAN mobile app or web portal. Classified as Protected B by the Government of Canada.

Processing

Computer Vision

Optical Character Recognition (OCR) processes images of vaccination proof documents to extract text. The system analyzes document images from photos uploaded through the ArriveCAN app or web portal.

Classification & Prediction

After OCR extraction, the system classifies the extracted vaccination data against applicable entry requirements to determine whether a proof of vaccination is recognized or unrecognized, flagging cases for manual review where needed.

What it does

Sensing (Perceptive AI)

Human decides

OCR technology reads and extracts text fields from images of travellers' proof of vaccination documents. The structured output is then used by border services officers to inform their eligibility and quarantine assessments.

Deciding (Analytical AI)

Human decides

After OCR extraction, the system processes the recognized vaccination data to assess whether the document meets applicable entry requirements, producing a classification result (recognized / not recognized) that assists officers.

Outputs

A recommendation or prediction

Anonymized data

The system outputs a vaccination recognition result (recognized or not recognized) that assists border services officers in determining a traveller's eligibility to enter Canada and any applicable quarantine requirements. The system does not make binding administrative decisions.

Run by

Public Health Agency of Canada (PHAC)

Federal agency responsible for public health in Canada. Deployer of ArriveCAN and accountable for the Proof of Vaccination Recognition system under the Quarantine Facilities and COVID-19 Border Measures program.

AIA — ArriveCAN

Built by

Not stated by the Helpful Places.

Kept for

Retained Not specified in the AIA

The AIA confirms data is retained (an audit trail recording all recommendations and decision points is maintained), but the specific retention period is not stated in the assessment. The system interfaces with federal government IT systems; data is subject to applicable federal privacy and records management legislation.
Duration: Not specified in the AIA

Shared with

Not available to me

Individual travellers do not have direct access to the vaccination recognition outputs or internal system records generated about them by ArriveCAN. The data is held by the federal government (Public Health Agency of Canada) and used for border and post-border enforcement purposes.

Available to the accountable organization

The Public Health Agency of Canada and Canada Border Services Agency have access to system outputs and audit trails. Data collected through ArriveCAN is also used to support post-border enforcement actions.

Stored

Stored locally

Data is controlled by the federal government of Canada. The system interfaces with federal IT systems. Data is classified as Protected B and subject to Canadian federal privacy legislation (Privacy Act) and the Directive on Automated Decision-Making.
Duration: Not specified in the AIA

How to read the colours

Can it identify you?

Anonymized data: Data about people with the link to who is broken. Stripped of identifiers, blurred, aggregated, or noised so this system can’t reasonably tie a record back to an individual.
Pseudonymous data: Each person’s data is tied to a token (hash, ID, template) that lets this system recognise the same person across events, but the token itself doesn’t reveal a name. Reidentification is possible with extra information.
Identifiable data: The data either contains a direct identifier (name, address, account name, recognisable face or voice, plate number) or carries a token this system uses to look up legal identity during processing.

Who completes the loop?

Human decides: This mode suggests; a person decides what to do next. The AI is always advisory — a human is in the loop on every decision. Example: a triage tool ranks cases for a clinician who chooses which to see first.
Human executes: This mode decides; a person carries out the result. Example: an optimizer plans the day’s trash-collection routes, and drivers run them.
Autonomous: This mode decides and acts on its own. No person reviews each decision or carries out the resulting action.

Definitions from the DTPR standard. Amber is about your data, violet about who decides. The fuller the shape and the deeper the colour, the more identifying the data or the less a person is involved.

What you can do

Ask about this system

Questions go to the Helpful Places, not the vendor.

Your rights

Right to Be Informed of AI UseTravellers are informed that ArriveCAN uses automated systems to process their vaccination documents. Plain language notices are posted through all service delivery channels including internet, in-person, mail, and telephone, as required under the Directive on Automated Decision-Making.
Right to a Human ReviewIf ArriveCAN cannot recognize a traveller's proof of vaccination, a border services officer will manually inspect the document and determine eligibility and post-border requirements. Officers have full discretion to override or disregard system outputs. Human override of system decisions is enabled.
Right to ContestA recourse process is established for clients who wish to challenge decisions informed by the system. Travellers may request manual review by a border services officer. The system is able to produce reasons for its decisions or recommendations when required.
Right to Algorithmic TransparencyPlain-language notices describing the automated system's role are available through all service delivery channels. Documentation on the design and functionality of the system is required under the Directive on Automated Decision-Making. Note: the algorithm used is a trade secret and full technical details are not publicly disclosed.

Risks and safeguards

Civil liberties harmThe system processes personal health data (vaccination status) at the border, an area of intense public scrutiny. Discriminatory or inaccurate OCR output could disproportionately affect travellers whose documents use non-standard formats, languages, or scripts. The algorithm is a trade secret.Safeguard: The system is advisory only — border services officers make all final decisions and can manually inspect documents when the system fails to recognize them. A recourse process is established for travellers who wish to challenge outcomes. A Privacy Impact Assessment has been completed. Gender-Based Analysis Plus was conducted. Audit trails record all recommendations. Plain-language notices are posted across service delivery channels.
Reputational harmAn incorrect non-recognition of a valid vaccination proof could delay or stigmatize a traveller at the border. Misclassification based on document format could create a false impression of non-compliance.Safeguard: Human override is enabled — border services officers can and must manually verify documents when the system cannot recognize them. The system produces reasons for its outputs, and an audit trail records all recommendations to support review and correction.