When Tobias Denskus, a professor of international development in Sweden, applied to come to Canada in February 2019 to renew his permanent residency it wasn’t just the “bad experience” that concerned him.
He said he was alarmed at handing over his most sensitive information to VFS Global, a massive visa outsourcing corporation. Until 2019, the company operated out of Mauritius, a known tax haven, and is also backed by a Chinese state-controlled investment fund.
“My impression after going through the process with VFS was that it felt much worse than dealing directly with Canadian government entities, dealing directly with Immigration Canada,” Denskus told Global News from Malmo, Sweden.
He said his application was delayed for weeks because the company failed to inform him that only UPS would deliver to their offices in Stockholm.
“I felt quite sorry for those who experienced this for the first time, for example, for a study abroad or work visa, that their first interaction with Canada as a country is actually through a rather peculiar corporate entity,” Denskus said.
From 2009 to 2019, Canada has awarded $183,204,308 to VFS Global to handle visa application submissions and biometric data collection at Canadian visa application centres in more than 80 countries, according to a Global News analysis of federal contracts.
And as the country moved to privatize parts of its visa application process, immigration, privacy and security experts say the lack of transparency and oversight of the visa outsourcing giant should be a major concern for Prime Minister Justin Trudeau’s government.
“This is the invisible big brother Goliath collecting literally hundreds of millions of cases of private information centralized under one private company,” said Richard Kurland, an immigration lawyer based in Vancouver.
“My concern is where oh where is the oversight, monitoring and control of this private company?”
Although VFS Global says it’s headquartered in Switzerland and the United Arab Emirates, Canada’s contracts are signed with VF Worldwide Holdings, which up until 2019 was headquartered in Mauritius – an island off the coast of Madagascar known for enabling questionable tax avoidance measures.
Another $10 million in contracts was awarded to TT Visa Services, also owned by VFS Global, to handle visa applications in 24 countries, including the United States and several in South America.
Founded in 2001 by Zubin Karkaria, who is still the CEO, VFS Global is a giant in the world of visa processing, having completed more than 224 million applications, containing sensitive personal and financial information, and operates in 144 countries, according to the company’s website.
The company is now primarily owned by EQT VII (No. 1) Limited Partnership, which is backed by Chengdong Investments, a subsidiary of the state-run China Investment Corp., according to documents filed with Britain’s corporate registry. The link to the Chinese-state owned firm was first reported by the Globe and Mail.
VFS chief communications officer Peter Brun said the company takes “customer service extremely seriously” and invests “significantly in all aspects of the application process.”
“It is in the nature of every high-volume customer-facing services business that customer complaints do occur,” Brun said. “We respond to 24 customer queries a minute on an average with a complaint resolution score of 99%.”
VFS Global said it complies with the “tax laws and practices in the countries in which we operate.”
“We pay all taxes according to the Canadian provincial and federal tax laws,” Brun said.
“Earlier media reports allege that VFS Global has a Chinese, German or American ownership. This information is completely wrong and based on incorrect information without proper fact-checking. VFS Global is owned and controlled by its Swedish-Swiss investors.”
Both EQT VII and VFS Global denied that Chengdong Investments or any investor has access to VFS data.
“Investors have no access to the EQT portfolio companies’ client and customer databases, nor do they influence the portfolio companies’ decision making or strategies,” said EQT spokesperson Daniel Ketema.
Connection to China investment firm
Anyone wanting to work, live or study in Canada from countries like China, Russia, the Philippines, India or the United Kingdom may have used VFS Global. Even Canadians applying to countries like the United Kingdom may have handed over personal data to the company.
VFS provides mostly administrative support, handling tasks such as fingerprinting and passport collection. Applicants will often apply for their visa through VFS rather than with the Canadian government directly.
In November 2012, the company won a $51-million contract under the former Conservative government of Stephen Harper. And since 2017, the company has been awarded an additional $132-million worth of contracts, according to information listed on the federal procurement website.
Former CSIS director Ward Elcock told Global News that any connections between VFS Global, a company that receives significant funding from China, should be closely reviewed by Ottawa.
Get daily National news
“Is there a risk? Yes,” Elcock said, speaking about the potential for Chinese state actors to access data related to Canadian visa applications. “But just because there is a Chinese company that’s an investor doesn’t by definition mean that there is a risk to Canada.
“Contracts like this are ones that ought to be treated sensitively and the government ought to be sensitive to the potential risks,” he said.
“The government needs to have done the work to ensure that the contract is not giving access or it does not effectively give access to very sensitive data to another regime.”
Meanwhile, Kurland said the federal government’s push to privatize visa application processes has saved the government “tens of millions of dollars” to deliver its immigration and visa system. In-person immigration officers still make final decisions on who is granted a visa.
“My goodness, it’s a great arrangement,” he said.
But Kurland said he’s alarmed by the massive amounts of data the company stores and the fact it was previously based in what Oxfam and the European Union have called among the world’s worst tax havens.
“If there was a complaint, monitoring oversight or problem, you’re out of luck. While contractually this private company is required to abide by Canadian laws, including privacy laws, it’s unenforceable,” he said. “How is an individual around the world or in Canada going to redress problems with a private company located in Switzerland or some other jurisdiction?”
VFS strongly rejected those allegations, saying it deletes all personal data “30 days after a passport and documents have been returned to the applicants.”
“VFS Global does not store any personal data related to a visa application,” VFS spokesperson Brun said in an email, adding that the company was “re-domiciled” from Mauritius to Dubai in 2019.
2015 privacy breach
In 2015, the company experienced a serious privacy breach that allowed personal information of Italian visa applicants, including their date of birth, passport details and addresses, to be exposed online.
IRCC says it has no record that VFS ever notified the Canadian government of this breach.
Meanwhile, VFS said that a “small number of application data” was “potentially accessible for a short time.”
“The gap was closed immediately. This was not related to any Canadian visa application and respective systems for the Canadian client government,” the company said.
VFS Global said in a statement that it prioritizes efforts to improve “cyber security processes” to keep up with changing threat scenarios.
“As a service provider to IRCC, any data protection incidents will be reported directly to IRCC. If required, IRCC would inform the privacy commissioner,” it said.
Former Ontario privacy commissioner Ann Cavoukian was shocked about the potential concerns around how this company handles and retains data and what kind of oversight exists. VFS Global’s website does indicate complaints can be directed to the Canadian privacy commissioner.
“But how the heck would they engage in any oversight over that? This company is huge and it’s all over the place,” Cavoukian said. “And I couldn’t get a sense of where was the information retained? And who else could perhaps have access to it.”
IRCC told Global News that while it was unaware of these privacy and oversight concerns, there is an extensive program in place to make sure visa application centres comply with Canada’s privacy laws.
However, Kurland worries that, while safeguards exist, they are not being used effectively.
“It’s an honour system arrangement,” says Kurland.
“How can the privacy commissioner find out whether data was deleted in Bangladesh, or pick your country? How can they possibly know?”
And if a visa applicant’s confidential personal information is breached through the use of VFS, the Canadian government is not liable for any damages, according to a 2008 VFS contract obtained by Global News.
VFS Global said it “complies with the data protection and privacy regulations of all countries we serve.”
“We have a dedicated Privacy and Group Data Protection Officer who is responsible for immediate communications with respective authorities,” Brun said.
Meanwhile, John Atkins, an immigration lawyer based in the U.K., said his clients regularly run into problems with VFS Global. He says some have even been denied visas due to mishandled documents, improperly uploaded information or other administrative errors.
He said dealing with the company is a “nightmare.”
“I’ve even got it in my client engagement letter that you will have problems with the (VFS) application,” Atkins told Global News from his home in Exeter, U.K. “I’ve been raising the matter of due diligence with the Home Office for two years. So it was the due diligence. Who’s monitoring all this?”
IRCC told Global News it does not track the total number of complaints generated by users of VFS Global or at visa application centres.
“IRCC takes Client complaints at the Visa Application Centres very seriously, investigates each case according to the severity and takes remedial action as needed,” IRCC spokesperson Beatrice Fenelon said in an email.
“Because IRCC does not differentiate general complaints from VAC-related incidents, IRCC is unable to provide a specific number of complaints regarding VACs.”
Kurland is representing dozens of plaintiffs in a $194-million class action against the Canadian government that alleged that foreign visitors were charged more than it cost to process their visa applications.
“You’re placing at risk the data of people in your country in the long term. Remember, this is not a one-snapshot deal. This privatized data contains the information to effectively give governments around the world of whom is related to whom in your family. And that’s on a global scale.”
The lawsuit covers over two million multiple-entry visa applicants who overpaid the Canadian government, some by as much as $55 per application between 2009 and 2015, according to the lawsuit.
Under the Financial Administration Act, the government cannot charge service fees in excess of the actual cost of providing a service. VFS was not named in the lawsuit.
According to a statement of defence, lawyers for the attorney general of Canada are seeking to have the case dismissed, citing a six-year limitation period on when claims can be made and denying that fees paid exceeded the cost of the services provided.
Avvy Go, director of the Chinese and Southeast Asian Legal Clinic in Toronto, has had several clients who have used VFS Global Services.
“(Canada) should be doing it in-house so that there will be proper oversight and protection of the private information that these individuals hold,” she said.
“I didn’t even know that the company was part of a privacy breach until you told me about it and that’s very problematic.”
Other foreign nationals who spoke with Global News said that while they didn’t have a negative experience with VFS, they were concerned about how the outsourcing of visa applications works.
“Data is the most valuable commodity right now,” said Edwin Dioso, who is from the Philippines and currently living and working in the United States. “Usually, we would rely on the strong arm of the government to protect our data. But if it’s a third party, it’s a private company, then I’m not so sure.
“Visa application work is the last thing governments should outsource.”
According to documents obtained by Finance Uncovered – a U.K.-based investigative news agency – VFS holding company accounts filed in Luxembourg show that revenues increased 60 per cent between 2016 and 2018.
The company reports that its growth has been driven by “higher value added service revenues,” meaning more applicants buying expensive premium services, which lawyers say have led to the “commercialization of life decisions.”
The company has also been accused of pressuring visa applicants into buying “premium” services – like a VIP-style waiting lounge – that they often don’t need and can’t afford, according to Finance Uncovered. For applicants looking to come to Canada from the Philippines, the premium lounge costs C$69.76, for example.
According to a VFS spokesperson, these premium services were created “in response to customer demand for greater accessibility, personalization, and convenience in visa services,” and are clearly identified as optional to customers.
While other countries receive a portion of revenues from VFS Global, Canada does not. Canada’s contract with VFS is set to expire on Oct. 31, 2023, but can be extended.
Comments