On May 20, 2025, the Commission d’accès à l’information du Québec (CAI) issued a decision regarding the use of in-vehicle video surveillance technology by a delivery company, 13859380 Canada Inc., dba Crane Supply (the Company). The CAI concluded that the Company did not sufficiently minimize the collection of personal information through its video surveillance system and ordered the Company to take steps to bring its use of the system into compliance with Quebec’s private sector privacy legislation.
Background
The Company is a wholesale distributor of products for the construction industry that operates throughout Canada. Its vehicle fleet includes heavy vehicles (3-ton, 5-ton and 10-ton flat trucks) and pick-up trucks. The Company installed a video system in all of its vehicles that allowed for the recording of the exterior and interior of its vehicles, although the CAI’s decision only considered in-vehicle recording. The system recorded video footage from when the vehicle was turned on and up to 20 minutes after the engine was turned off. The system included artificial intelligence-driven functionality that would detect and generate a report for certain events, including the driver using a mobile phone while the vehicle is moving, the driver smoking in the cabin, the vehicle’s speed exceeding the speed limit by more than 20 km/h, and a possible collision involving the vehicle.
The CAI conducted an investigation into the Company’s use of the in-vehicle video surveillance system in response to a complaint. Following its investigation, the CAI issued a notice of order to the Company, indicating that while it did not take issue with the use of the system in connection with the video recording from inside heavy vehicles on the basis that this collection was for legitimate, real and important purposes, it intended to order the Company to stop recording from inside pick-up trucks specifically on the basis that this collection did not satisfy the “real” character required by law. The Company was given the opportunity to present its observations in response to the notice prior to the CAI issuing its final decision, which ultimately addressed the use of the system in both heavy vehicles and pick-up trucks.
The CAI’s Decision
Under Quebec’s Act respecting the protection of personal information in the private sector (Quebec Act), an enterprise that, for a serious and legitimate reason, collects personal information must determine the purposes for collecting the information before doing so, and may collect only the information necessary for such purposes. To justify the necessity of the collection, an enterprise must demonstrate both (i) the legitimate, real and important nature of the purposes of the collection and (ii) the proportionality of the invasion of privacy constituted by such collection in relation to the objectives it pursues.
Legitimate, Real and Important Purposes
The Company’s stated purpose for deploying video surveillance included ensuring the safety of drivers and the Company’s property, preventing and detecting road safety violations, defending the Company and its drivers, conducting accident investigations, and improving driver training. The CAI found that these purposes were legitimate, real and important for both heavy vehicles and pick-up trucks.
The CAI extensively analyzed the “real” character of the purposes, that is, whether they were tied to a specific event or issue that justifies the collection of personal information. As it relates to video surveillance, the CAI emphasized that the objective of ensuring safety should not be used in a generic manner and should be linked to specific situations or risks. The CAI reviewed past labour and employment decisions of a similar nature, which noted that heavier vehicles were inherently more dangerous, and considered studies that examined the frequency of accidents involving both heavy vehicles and pick-up trucks and their severity, as well as statistics of the Company’s own incidents involving pick-up trucks. In revisiting its findings in the initial notice to the Company on the “real” character not being met in the case of pick-up trucks, the CAI found that it is “generally known” that there is an established likelihood of a vehicle being involved in an accident and that based on the evidence before it, when an accident does occur, pick-up trucks are more likely than other vehicles to lead to a serious or fatal accident.
Proportionality of Collection
In analyzing whether the collection of personal information is proportional to the purposes of such collection, the CAI found that the Company did not sufficiently minimize the invasion of the individual’s privacy. Here, the CAI took issue with a few key aspects of the Company’s use of the video surveillance system. First, the system filmed continuously and stored the entirety of the collected video footage for up to 14 days. The CAI considered that the purposes could be achieved by only recording for a limited number of seconds before and after a given accident. Second, the system collected and stored video footage not only when the vehicle was running, but also until up to 20 minutes after the engine was turned off. Since drivers were likely to take occasional breaks in their vehicle, the CAI concluded that this meant that drivers were likely to be filmed during periods that do not constitute working time.
The CAI also took issue with some aspects of the Company’s decision-making process. It noted that there was no indication that the Company had evaluated the possibility of using other systems or less intrusive privacy settings. It also highlighted that the Company’s policies were inconsistent with the representations it made to the CAI in response to the notice of order (including inconsistencies related to the video only being consulted in the event of accidents or major incidents).
Key Takeaways
This is the second CAI decision in recent months relating to the use of video surveillance technology. The level of detail and evidence considered by the CAI speaks to the regulator’s expectation that enterprises in Quebec that intend to use privacy-invasive systems such as video surveillance thoroughly evaluate the privacy impacts of such systems in advance, and only roll them out if they have determined (and are able to demonstrate) that these measures are (i) grounded in purposes that are legitimate, real and important and (ii) proportional to such purposes, including by ensuring that any impact on privacy rights is minimized to what is strictly necessary for such purposes. The CAI also emphasized that the purposes must be determined beforehand and that those purposes must be consistently communicated across the organization’s policies and other communications.
Organizations that use more invasive methods of collecting personal information, such as video surveillance, should carefully review their policies and practices and ensure that they can demonstrate that they are compliant with Quebec privacy laws. This includes conducting detailed privacy impact assessments in advance of implementing such methods and only moving forward if the assessment concludes that it is appropriate to do so.
For more information, please contact the authors or any other member of our Privacy & Data Protection group
