Evaluation of proposed recommendations

There have been increased calls for industry-specific regulation for connected cars given the ongoing digital transformation and associated high risks. However, automakers have suggested such a tailored approach would be inappropriate for Canadian privacy regulations and consumers would bear the burden of the adoption costs.

One proposed solution for industry-specific regulation is a code of practice for connected-car providers. A code of practice is an industry code designed with the involvement of market participants to establish good business practices and minimum standards for an industry. When evaluating the code of practice as a possible legislative solution, it is important to consider that this would align with the federal government's position outlined in the 2018 Senate Transport Committee study, "Driving Change: Technology and the Future of the Automated Vehicle, federal government response. In the report, the government suggested the preferred solution was the "development of an industry-specific code of best practices for privacy protection" instead of regulations. Given that the flow of data in the connected-car industry is complex, the government suggested developing the industry-specific code should involve multiple industry stakeholders.

There is evidence of the code of practice for connected cars serving as the regulation model in other jurisdictions for testing purposes, rather than for production. In the U.K., the government implemented a code of practice for testing and trials of automated and connected-car technologies. The code was designed to support safe trials of the technology, support cooperation between trialing organizations and encourage information sharing to develop high safety standards. This code was not, however, designed as a substitute for production standards. Thus, it is not a comparable international example for the Canadian government. Arguably, data protection should be considered during the design phase, when the system's functionality is being established.

Although a code of practice can establish trust within the market and create a fairer economic environment, there are some challenges to consider. Industry codes can have litigation risks for firms because litigants can rely on them in actions against a firm and regulators can use them to investigate suspected misconduct. The level of risk depends on several factors, including to what extent, if at all, a firm references the code within contracts, marketing materials or its agreement to adhere to a code. Express references to an agreement to a code within contracts will likely render the code obligatory. However, references to an industry code within contracts can lead to implied terms if the code is considered necessary for the business efficacy of a contract. The enactment of legislation with clear enforcement mechanisms would likely be more effective than a code of conduct if the interests of market participants can be appropriately reflected to avoid stifling innovation.

It is important to note Bill C-27 includes a codes of practice concept that allows private companies to establish "code" and certification programs for complying with the Consumer Privacy Protection Act internally, which requires approval from the OPC. After approval, the established code sets the standard for the company's legal compliance requirements.

Regulatory guidance from the EU

The European Data Protection Board published guidelines on the processing of personal data in the context of connected vehicles and mobility-related applications, which identify areas of risk for organizations and establish measures that should be adopted to ensure that technology complies with the law. Within the guidelines, personal data is defined as data that is processed within a vehicle, communicated between a vehicle and a connected device such as a smartphone, and vehicle telemetry that is sent to external entities such as the manufacturer, insurance company, vehicle repair company or another service provider.

The guidelines help create risk-mitigation measures to promote compliance. These include guidance such as prompting companies to consider the specificity and frequency of data collection for each functionality. An example is a weather application that can access a vehicle's location at longer intervals, instead of at every second. Another relevant recommendation is to communicate accurate and appropriate information about the purposes and occurrence of data processing, such as how data can be shared with third parties and how long data storage lasts. Users should be able to deactivate location tracking at any moment.

The guidelines also provide important considerations for processing biometric data, which automakers increasingly collect. When biometric data is used for purposes such as authentication or accessing a vehicle, the data should be stored and compared in encrypted form on a local level instead of transmitted externally. The guidance has helped facilitate connected-vehicle compliance with the GDPR. Canada does not currently have equivalent guidance available.

The importance of addressing the risks of anonymized and aggregated data in legislation

When considering which legislative solution would be appropriate to address the privacy risks associated with connected cars, it is important to consider the risks of anonymized and aggregated data. When significant quantities of data are collected, despite anonymization, the reidentification risk can be higher if the data is intercepted or there is a breach. The mere use of anonymized and aggregated data does not isolate a business from the risk of privacy breaches. A business must engage in continuous scrutiny to prevent reidentification risks from emerging.

Given the risk of reidentification of anonymized data in the event of a data breach, it is important to consider mitigation measures. For instance, companies should limit data transmission by processing data on a local level and using encryption wherever possible, especially when local processing is not feasible.

The consent challenge

Consent, if uninformed, is not meaningful consent. The concept of consent at an individual level, which protects citizens' autonomy, is a central tenet of Canadian privacy sector laws. As suggested by the federal and provincial working group on connected cars, the complex design of connected cars can make it difficult for individuals to make informed choices about the handling of their personal information. This means meaningful consent is a concept that should be highlighted in connected-car companies' design processes to remove consumers' lack of awareness. For example, individuals should get choices about their personal information, such as the ability to turn sensors on and off or request deletion of user histories, with clear yes and no options.

Companies should also consider the perspectives of those who cannot consent, such as pedestrians whose images may be inadvertently captured by cameras. Companies can hedge against privacy risks to such third-party pedestrians by including automatic deletion or deidentification of this data. To address individuals' capacity to consent, former Privacy Commissioner of Canada Daniel Therrien, jointly with the Office of the Information and Privacy Commissioner of Alberta and the Office of the Information and Privacy Commissioner of British Columbia, released new guidelines in 2019 on consent under PIPEDA. These suggest companies should employ communication strategies to explain their privacy practices more effectively, such as customized mobile interfaces and "just-in-time" notices. However, it is important to note these recommendations, while relevant to the issue of data privacy in connected cars, are not enforceable and are simply guidelines. The clarification of connected-car consent is an issue that should be set out in legislation to enforce compliance and clear breach mechanisms.

Conclusion

Consumer interest in connected cars is growing and the technology continues to rapidly evolve, providing clear benefits such as increased safety and efficiency in vehicles. Currently, the regulatory environment in Canada is in flux, as there is no dedicated connected-car legislation and legislation that would address this issue is still forthcoming. Looking to other jurisdictions, the EU has developed principles that clearly apply to connected cars, such as the right to erasure found in the GDPR. When developing a legislative response, the Canadian government needs to consider several factors that have been highlighted as key concerns by experts. These include considering regulatory guidance from leading jurisdictions, such as the connected-car guidance published by the European Data Protection Board. They should also consider including requirements for companies to address the risks of anonymous and aggregated data within legislation. Through considering multiple stakeholders' interests, consumers' needs and other jurisdictions' guidance, federal and provincial governments can successfully align on legislation and develop regulatory frameworks that protect consumers without limiting innovation.

Search resources

Featured resources

Connected Cars: The legislative environment, potential reform and privacy issues

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

EU Cyber Resilience Act: 101

EU Product Liability Directive Reform: 101

Top 10 operational impacts of the EU AI Act – Post-market monitoring, information sharing, and enforcement

Connected Cars: The legislative environment, potential reform and privacy issues