ArriveCAN was mandatory for use for travellers, and, for some people, travel is required for their employment or to access medical services, but it's also part of their rights as Canadians to travel freely. The use of the app was mandatory, and the collection of data was mandatory. They had to surrender their personal information.
What would the consequences be should you find that CBSA or that the government broke the law, broke the Privacy Act?