Madam Speaker, I am thankful for the chance to address the question from the hon. member.
I want to start by emphasizing that safeguarding applicants' personal information and privacy is always the top priority for Immigration, Refugees and Citizenship Canada, or IRCC, and the Government of Canada.
In fact, IRCC uses visa application centres, or VACs, to provide administrative support and biometric collection services in local languages to visa applicants. VACs do not play a role in the decision-making process and are expressly forbidden to provide any visa-related advice to applicants. All decisions are made by highly trained IRCC officials.
As well, all immigration information gathered at VACs is transmitted directly to Canada and is stored in Canada. This is a one-way process and operates similarly to a client-facing web page. No immigration data is retained at the VACs, and Canadian officials closely monitor the activities of VACs around the world to ensure that privacy standards are met, as per Canadian laws. In addition, the Government of Canada performed its due diligence in vetting the contractor, VFS Global, and has required that all employees in VACs who have access to personal information, including subcontractor employees, are screened to Canadian standards.
I should also note that Public Services and Procurement Canada's contract security program, in partnership with IRCC, commissioned the lead Canadian security agencies to establish the required measures. Their advice was an integral part of the contractor screening process and was used to identify the risk mitigation strategies that should be considered when opening VACs around the world.
As the hon. member understands very well, there are risks to operating in any foreign environment, and the Government of Canada is well aware of the risks of operating in China. IRCC officials closely monitor the activities at visa application centres to ensure that our stringent privacy standards, as detailed in the contract, are met.
As part of this work, since the beginning of the contract, IRCC has regularly carried out audits and inspections for compliance at all VACs around the world. This includes both scheduled and unannounced audits and site reviews conducted by IRCC officials. Since 2018, IRCC has reviewed and conducted over 20 site visits to VACs in China alone. IRCC video cameras also monitor every time biometrics are submitted.
The contractors must notify Canada immediately of any data breaches at the VACs, as well as any other situations or difficulties that may arise or will have an impact upon the scope of the work, security and protection of personal information included. IRCC is responsible, in consultation with PSPC, for determining whether a reported problem constitutes a privacy breach, and if a privacy breach were to occur, a report would be created to report how the breach occurred, the remedial actions being taken and the mitigation measures proposed by the contractor to prevent reoccurence. No privacy breaches have been reported to date.
VFS Global has been compliant with its security requirements pursuant to its contract with the Government of Canada. The Government of Canada will continue to improve and implement measures to enhance security requirements, especially in the international context.