For citizenship applicants, IRCC sends a referral to RCMP and CSIS to do background checks. IRCC also does a GCMS/FOSS check which includes, at the least, criminal name-record checks into Canadian and U.S. databases (at least a version of the U.S. database shared with Canada). Additionally, some applicants are required to provide police certificates from other countries (in particular, applicants who have spent a total of 183 or more days in a country other than Canada, within the previous four years, must submit a police certificate for that country with the application; IRCC may otherwise request other applicants to submit police clearances depending on an individual's particular circumstances).
I am not aware of any restrictions on the government's authority to do background checks on individuals. As far as I know, even local law enforcement could initiate a background check, no probable cause necessary (perhaps there must be an articulated reason but that bar is undoubtedly very low), and do so without even giving the subject notice they have done so.
Any time a traveler crosses the border between the U.S. and Canada, border officers on either side can conduct a background check, and in doing so both sides of the border can access records from either side.
For citizenship in particular, anyone with a criminal charge pending is prohibited from being granted citizenship, and anyone who has been convicted of an indictable offence in Canada, or any comparable offence outside Canada, within the four years prior to applying, is prohibited. And of course IRCC has the authority to investigate applicants to make sure there are no such criminal records or pending charges prohibiting a grant of citizenship.
There are additional reasons for background checks and other prohibitions. Periods of time on probation or while serving a sentence cannot be counted toward meeting the presence in Canada requirements, for example.
By the way, IRCC often does open source research as well, at least for some applicants. Thus, for example, more than a few applicants have run into problems because IRCC dug into LinkedIn account information which conflicted with information the applicant provided in the application form (typically involves inconsistency between reported work history and what was posted in LinkedIn).
All of which should be no surprise.
