CBSA should only retain travellers’ digital device passcodes when necessary
A Canadian traveler complained that the Canada Border Services Agency (CBSA) inappropriately collected his cell phone passcode during a border inspection. The complainant argued the collection was unauthorized and unnecessary, as he offered to unlock the phone himself. The OPC acknowledged CBSA's authority under the Customs Act to require passcodes for digital device inspections, citing reasons such as preventing data alteration and ensuring evidence continuity. However, the OPC found that the CBSA officer failed to follow policy by not taking notes and not informing the complainant about passcode retention and the option to change it. The OPC also questioned the necessity of retaining passcodes when no further action was taken. The CBSA committed to providing more training and revising its policy to ensure passcodes are handled more sensitively.
- 1Whether the CBSA has the authority to require a traveller to provide a passcode to unlock a digital device for inspection purposes under the Customs Act
- 2Whether the CBSA officer followed internal policies regarding the collection and retention of personal information (passcodes)
- 3Whether the CBSA's retention of the passcode was necessary beyond the examination process when no further action was taken
- 4Whether passcodes constitute sensitive personal information
- Passcode collection authority: Collection deemed authorized under Customs Act
- Officer's note-taking: Officer failed to take notes as per policy
- Informing about passcode retention: Officer failed to inform complainant about retention
- Informing about passcode change option: Officer failed to inform complainant about changing passcode
- Necessity of passcode retention: Necessity of retention questioned by OPC
- Policy and training commitment: CBSA committed to training and policy revision
Action warranted — CBSA committed to policy revisions and training
While the CBSA has the authority to collect passcodes, the investigation found that the officer failed to follow policy and the CBSA was retaining personal information unnecessarily. The CBSA committed to corrective actions.
The CBSA committed to providing more training to officers regarding personal information collection and to rewriting its policy to provide clearer direction on handling passcodes, including a more privacy-sensitive approach to their retention.
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro