Forward-facing video while the driver is on duty is defensible. Continuous in-cab audio is where Canadian fleets have actually been found offside — in a case about a truck.
Key takeaways
You can record what a defensible purpose actually needs, tell drivers before you deploy it, limit who can see it, and keep it only as long as the purpose requires. In practice that means forward-facing video is usually fine, event-triggered inward video can be justified with care, and always-on in-cab audio is the configuration Canadian regulators have already criticised.
The statutory hook is short: an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Everything else is the Commissioner’s method for answering that question.
The Office of the Privacy Commissioner applies a consistent test. Employers should consider the degree of sensitivity of the personal information at issue; whether the purpose represents a legitimate need or bona fide business interest; whether the collection, use and disclosure would be effective in meeting that need; whether there are less invasive means of achieving the same ends at comparable cost and with comparable benefits; and whether the loss of privacy is proportional to the benefits.
Note the shape of it. A legitimate need is not enough on its own, and neither is effectiveness. The two factors that fail most camera deployments are the third and the fourth — the less-invasive alternative that was available, and the proportionality of what was lost against what was gained.
In 2022 the Commissioner investigated a complaint by a truck driver about an in-cab camera system. The finding is unusually useful because the facts are ordinary fleet facts.
The system captured forward-facing video and in-cab audio and was continuously active whenever the truck was turned on, regardless of whether the truck was being driven or whether the driver was on or off duty. Event triggers retained a twelve second clip capturing eight seconds before the event and four seconds after, which a third-party processor classified as accidents, coachable events or informational clips before making them available through a portal.
The Commissioner accepted the safety purpose. The finding was that the organization could have achieved the same ends in a less privacy intrusive way, and the loss of privacy was not proportional to the benefits. The specific defect: the recommendation was to limit the audio functionality to be active only when a driver is on-duty and/or driving, and drivers could be recorded while resting or even sleeping in the sleeper cab, which one could describe as their bedroom.
Access control failed too. All clips within a branch or region were available to portal users in that region for 90 days through a “view all” tab, and the practice of simply instructing employees not to look at that view was an inadequate safeguard.
The design rule that follows
Bind recording to duty status, not to ignition. A camera that wakes with the engine will record a driver asleep in the berth of an idling truck, and that is the fact pattern the Commissioner singled out. Duty status is already known to your electronic logging system — use it.
Extra-provincial carriers are federal undertakings, and the federal private-sector statute applies to personal information about an employee of, or an applicant for employment with, an organization that it collects, uses or discloses in connection with the operation of a federal work, undertaking or business. The Commissioner’s own workplace guidance is explicit that PIPEDA applies to employee information in federal works, undertakings and businesses, such as banks, telecommunication companies and transportation companies.
A carrier operating only inside one province is generally under that province’s regime. In Alberta, the Personal Information Protection Act is the private sector privacy law for provincially regulated private sector organizations. In Ontario, there is no general private-sector privacy statute, but there is a specific monitoring obligation: employers that employ 25 or more employees on January 1 of any year must have a written policy on the electronic monitoring of employees, and where the employer does monitor, the policy must include a description of how and in what circumstances the employer may electronically monitor employees, the purposes for which the information may be used, the date the policy was prepared and the date of any changes.
The practical answer for a mixed fleet is to build to the higher standard once rather than maintain two policies.
Federally regulated employers can rely on an employment-relationship exception to consent, but not unconditionally. In the truck camera case, the organization was not initially transparent about its collection and use of personal information for disciplinary purposes, as required by section 7.3. It could rely on the exception only after it explained those purposes to employees.
This is the single most common failure in fleet deployments: the camera is introduced as a safety and exoneration tool, then used in progressive discipline that was never disclosed. Say it in the policy, in plain words, before the first clip is reviewed. The Commissioner’s guidance is that employers must make employees aware of the purpose, nature, extent and reasons for monitoring, as well as potential consequences for workers.
Nor can the problem be signed away. Telling employees that loss of privacy is a condition of employment does not align with consent needing to be clear, informed and voluntary.
Scope. Forward-facing video always; inward video event-triggered only; audio off, or on only while the driver is on duty and driving. Retention. A short default for uneventful footage, with a documented hold for incidents. Guidelines for retention should ensure information is not retained any longer than is necessary to fulfil the identified purpose. Access. Named roles, enforced technically. Transparency. A written policy issued before deployment, covering what is collected, why, how, the consequences for employees and how long it is kept. Access requests. Employee access rights extend to personal information collected for monitoring, so have a process before you need one.
On the evidentiary side, footage that is properly collected is also the footage most likely to be useful later; the sister firm’s articles on dashcam and surveillance footage as evidence in Ontario and workplace video surveillance law cover how that plays out.
A 22-truck Ontario carrier running Ontario-to-Michigan lanes wants cameras after two disputed collisions. It is an extra-provincial undertaking, so the federal statute governs its employee information.
It writes the purpose down first: exonerating drivers in disputed collisions, and coaching on hard-braking and following-distance events. It then tests the configuration against that purpose. Continuous audio is dropped, because the purpose does not need it and the alternative — audio only while on duty and driving — achieves the same ends less intrusively. Inward video is event-triggered. Retention is 14 days for untriggered footage and indefinite for anything attached to an incident file, with the hold applied manually by a named person. Access is limited to the safety manager and the driver’s own supervisor, enforced by the vendor’s role permissions rather than an instruction.
The policy is issued three weeks before installation, says in one sentence that footage may be used in coaching and, where warranted, in discipline, and explains how a driver can request their own footage. Twenty-two drivers acknowledge it in writing. Nothing about that sequence slows the deployment; it just means the file is defensible when the first driver asks who watched their clip.
Camera systems already use software to detect events, and that is a capability rather than a decision. The useful additions on the carrier’s side are administrative: applying retention rules automatically so untriggered footage expires and incident footage does not; logging every access to a clip so an access request can be answered; drafting the coaching note from the event data for a supervisor to edit; and tracking policy acknowledgements across the driver roster.
What it does not do is decide. Whether a clip shows unsafe driving, whether a driver is disciplined, whether footage goes to an insurer and whether a monitoring purpose is appropriate are judgements a person makes and signs. A classification produced by a camera vendor is an input to a human review, not a verdict.
Only within a purpose that needs it, and not continuously. The Commissioner recommended limiting audio to be active only when a driver is on-duty and/or driving after finding continuous recording disproportionate.
Federally regulated employers can rely on the employment-relationship exception, but only where they have been transparent about the purposes — including disciplinary ones. Consent cannot be used to waive the other obligations, and individuals cannot consent to having their personal information handled contrary to legal requirements.
It applies to Ontario employers that employ 25 or more employees on January 1 of any year. A carrier that is federally regulated is governed by the federal statute instead — but writing one policy that satisfies both is simpler than deciding which applies to each employee.
As long as the identified purpose requires, and no longer. Set a short default, apply a documented hold for incidents, and remember that employee access rights extend to personal information collected for monitoring.
A 30-minute call is enough to tell you whether AI pays for itself in your back office.
