Recently, Daniel Therrien, the Privacy Commissioner of Canada, made a written submission to the Standing Senate Committee on Transport and Communications on the privacy issues relating to connected vehicles. This submission supplemented the Commissioner’s oral remarks to the Committee on March 28, 2017.
The Commissioner’s written submission follows the release of the Office of the Privacy Commissioner’s draft guidelines on consent. Unsurprisingly, the Commissioner focused on the role of consent in protecting the privacy interests of consumers. The Commissioner allowed that “there may be some collections, uses or disclosures in which it might be inappropriate for the driver to control how the information is used.” The Commissioner cited the situation of the use or disclosure of data is “necessary” for road safety as an example. However, overall, the Commissioner’s emphasis is on consent and meaningful user choice.
The Commissioner’s room to manoeuvre is constrained by the requirements of the governing legislation that the Commissioner must enforce — the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA requires meaningful, informed consent for the collection, use and disclosure of personal information. The Commissioner’s emphasis on consent is understandable. 
However, if we think beyond PIPEDA, would we really design a consent-based model for the features of a connected car? Would this be the right way to balance the interests of vehicle manufacturers, vehicle owners/lessees, rental car companies, passengers, insurers, law enforcement, urban planners, cyclists, pedestrians, and others stakeholders? Given the stakeholders and the context — driving is a licensed activity — is this an area where there might be more room to apply a broader set of policy considerations instead of focusing on consumer choice? Should the focus really be on notice and consent?
A multi-faceted approach would acknowledge that certain interests may take priority over consumer choice when engaging in a licenced activity. For example, manufacturers and Transport Canada have a legitimate interest in detecting vehicle flaws that could endanger passengers and others. Manufacturers and environmental protection agencies also have a legitimate interest in continual improvement of the longevity and energy efficiency of vehicles. Moreover, city planners and transportation managers have legitimate interests in affecting traffic flows in real time and understanding driving behaviour with greater precision using larger data sets. Do these interests rise to the level of “necessity” as the Commissioner would suggest might be required in order to jettison a notice and consent model? Should they have to?
There are also other means to regulate uses of information in order to mitigate harms to individuals without focusing on consumer choice. Manufacturers and others could be encouraged to implement privacy enhancing features by eliminating the need for consent when the collection, use and disclosure of information falls within a socially acceptable zone that involves few risks. Using technology to limit harm could be supplemented with targeted regulatory protections that do not prohibit the collection of data but rather discriminatory or other harmful uses of the data. Long before we had statutory privacy laws in most of the country, we had human rights legislation prohibiting certain harmful, discriminatory uses of personal information.
Just a thought.
Click to read the Commissioner’s Submission to the Standing Committee.
Click to read the draft Guidelines on Consent.
Categories: Connected Cars, Privacy