Use of biometric data and facial recognition technology Use of biometric data and facial recognition technology

Table of Contents

• Société 13859380 Canada Inc., 1031833-S, May 20, 2025

---

Société 13859380 Canada Inc., 1031833-S, May 20, 2025

Read the case details [PDF]

Facts

The Commission d’accès à l’information (the CAI) launched an investigation following a complaint regarding the use of a bidirectional video surveillance system installed in delivery vehicles by 13859380 Canada Inc. (the company), a wholesale distributor of pipes, valves and related products operating under the trade name Crane Supply.

The system captured images from both the interior and exterior of vehicles. Drivers were required to identify themselves by entering a personal identification code on their company-provided cellphone before operating a vehicle, thereby associating the recorded images with the specific driver.

The system also incorporated artificial intelligence (AI) functionalities designed to detect specific in-cabin events — including cellphone use while driving, failure to wear a seatbelt, smoking, potential collisions, tailgating, excessive idling and speeding — and generate daily incident reports shared with branch managers. These reports listed detected events and drivers involved but did not include video footage or images.

According to the company’s internal policy, access to the recorded images was restricted to three senior managers. The company justified the data collection by stating that it was necessary to achieve certain objectives, namely: to ensure driver safety and property protection, to prevent and detect highway safety code infractions, to facilitate accident investigations and to improve driver training.

Decision

The CAI found that the company’s data collection objectives outweighed the privacy harm to drivers but concluded that the company failed to implement sufficient measures to minimize the privacy intrusion.

In its reasons, the CAI confirmed that the Act respecting the protection of personal information in the private sector, C.Q.L.R., c. P-39.1 (the Québec Private Sector Act) applied to the company and that the images captured inside vehicle cabins constituted personal information. Under section 5 of the Québec Private Sector Act, the CAI determined that the company’s objectives were real, legitimate and important, thereby satisfying the necessity requirement.

The CAI distinguished between vehicle types: for heavy vehicles, their inherent dangerous nature and a documented history of accidents substantiated the legitimacy of safety-related objectives; for pick-up trucks, the company failed to prove they were disproportionately involved in accidents, though the CAI acknowledged the inherent risk of driving on public roads, which is heightened in collisions involving pick-up trucks.

Despite agreeing with the stated objectives, the CAI concluded that the company had not taken sufficient reasonable steps to minimize the privacy intrusion. The CAI noted that the company did not adequately evaluate less intrusive alternatives; the system continued collecting images for 20 minutes after engine shutdown, including during driver breaks; and there were inconsistencies between the company’s policy and its stated practices regarding access to and use of the collected images. The CAI ordered the company, within 90 days, to:

• limit interior cabin image collection to a limited number of seconds before and after a determined incident, or, cease collecting interior images entirely
• cease collecting interior images after engine shutdown and
• destroy any interior cabin recordings exceeding the sequence related to an accident or significant incident

The CAI also recommended that the Company revise its policy to restrict access to interior cabin images to cases of accidents or significant incidents.

Key takeaways

This decision provides important guidance to employers on the necessity requirement under the Québec Private Sector Act for video surveillance systems in commercial vehicles.

While the CAI recognized that safety-related objectives in the transportation context can be legitimate and may outweigh the resulting privacy intrusion, employers must take reasonable steps to minimize the collection of personal information, evaluate less intrusive alternatives, and ensure their policies clearly indicate and limit the circumstances in which recorded images may be accessed, used and by whom.