On April 16, Canada privacy commissioner Philippe Dufresne discussed privacy concerns related to the Canada-China preliminary joint arrangement on Canada’s electric vehicle sector before the House of Commons standing committee on science and research.
Dufresne told the committee many cars are presently linked to the internet, providing advantages like real-time navigation assistance, facilitated roadside assistance, and mobile device integration. However, through this link cars accumulate much personal data such as location history, driving behaviour, and personal preferences. This information can then be transmitted to or saved in foreign jurisdictions without proper safeguards and accessed by other governments, law enforcement, or courts.
He noted that the Personal Information Protection and Electronic Documents Act does not specifically tackle trans-border data flows, although it mandates transparency from organizations regarding the transfer of personal data to foreign jurisdictions and makes organizations responsible for personal data transmitted to third parties for processing.
Thus, Dufresne recommended that the federal government specifically tackle cross-border data flows in private-sector privacy law reforms, ensuring that Canadians’ personal data are protected before they are transferred to other jurisdictions where “different legal frameworks and data protection standards can increase the risk of access or use of personal information, including access by foreign courts, law enforcement, and national security authorities.”
“This could include requiring privacy impact assessments before data moves beyond Canada’s borders and providing for specific tools to ensure that data is afforded a comparable level of protection when it travels outside the country. This could be accomplished through, for example, standard contractual clauses, codes of practice, and certification programs,” he said in his statement before the committee.
Dufresne added that his office’s contributions program has backed studies into connected vehicles; one research project reviews the privacy permissions and releases Canadians must give automakers to access on-board features and connected applications in new vehicles. Another study investigates how privacy by design can enhance protection when companies access identifiable data obtained from vehicles. Dufresne said he expected the findings to be released in the coming months.
He said that as the new Global Privacy Assembly chair, he prioritized collaboration with international counterparts to secure cross-border flows of personal information.
“My office also supports the exploration of data transfer mechanisms that can provide businesses with regulatory certainty and that Canadians can trust, such as the Global Cross-Border Privacy Rules (CBPR) Forum certifications,” Dufresne said.