The government has in place many policies and directives that should guide the development, construction and deployment of an app like ArriveCAN. What's boggling in this instance is that it essentially threw all of these well-developed policies out the window. For example, the directive on automated decision-making states that there should be an algorithmic impact assessment done at the time artificial intelligence will be deployed, so when that is constructed at the outset of the program, that will do that. That never occurred.
The only algorithmic impact assessment that is available, to my knowledge, is one that was done a year and a half after ArriveCAN was introduced. The policy, the directive, says that the assessment should also occur whenever the app is significantly updated. That occurred at many instances, but rather than adhering to its own policies, the government simply unveiled the developments in the app store. That's what got the government into trouble when it introduced an advance CBSA declaration into the iOS version of the app, because it was an update in June that caused the glitch.