I essentially asked the CBSA's media arm for information about what personal information bank, as required in the Privacy Act, they'd been placed into. The CBSA media arm refused to provide any answer whatsoever, which led me to believe that they simply had not done it.
As for this data, which had been collected and retained for a minimum of two years with no expiry, as the privacy notice for ArriveCAN itself stated, who knew where it was going? Who knows where it is now?