Office of the Privacy Commissioner of Canada to fund code of practice for connected cars

Published: March 30, 2017

Updated: July 24, 2018

Author: Luke Jones



The Office of the Privacy Commissioner of Canada has announced it will fund the development of a code of practice for connected cars. The “arms-length” project will seek a standard for balancing information flow and protecting data privacy.

“The benefits available to Canadians through the arrival of connected and autonomous cars may be significant,” Privacy Commissioner of Canada Daniel Therrien said in remarks on Tuesday before the Senate Committee on Transportation and Communications. “However, consumers’ trust in these technologies will only take hold when the appropriate balance is reached between information flow and privacy protection is struck.”

Therrien was before the committee as part of a wider study into regulatory and technical issues that could affect the creation of connected and automated vehicles. Privacy is a major challenge for vehicles that will always be connected and communicating with other vehicles and systems. Therrien says:

  • In the face of the complex data flows involving many different players in the connected car ecosystem, we must ask ourselves who is ultimately accountable for what? More concretely, which company or public sector institution would the average driver contact when they have a privacy concern?
  • When a person sells their car, or returns their rental, is there an easy mechanism to ensure that infotainment systems are thoroughly wiped such that no one has inappropriate access to information about them?
  • More fundamentally, how are collections, uses and disclosures of information being communicated to individuals, so that they have a real choice in providing consent or not to services that are not essential to the functioning of the car?

“On this last point, my office is currently examining potential enhancements to the consent process, to address many of the challenges raised by the flow of large amounts of data through complex ecosystems, as can be seen in the connected car industry and more broadly in the Internet of Things,” Therrien said in the meeting.

During the Office of the Privacy Commissioner of Canada’s consent consultations, Therrien said the office heard that “Canadians are greatly concerned about the lack of clarity and accessibility of privacy policies. They claimed that posting a legalistic privacy policy on a website is not an effective means of providing notice, although it appears to be the method chosen by automakers.”