You are required to collect most of it. The question the law actually asks is what else you then use it for.
Key takeaways
You may collect it — in a regulated fleet you are required to — and you may use it for the purposes you told people about. What Canadian law constrains is purpose, notice and reuse, not collection. Two regimes run at once and people conflate them: privacy law asks whether the purpose is appropriate and whether consent is meaningful; Ontario’s employment-standards rule asks only whether you have written down what you do and given every employee a copy.
The second one is worth stating plainly because it is widely misread. Ontario’s requirements do not establish a right for employees not to be electronically monitored by their employer and do not create any new privacy rights for employees. It is a transparency duty. The privacy analysis is separate and lives elsewhere.
An electronic logging device is defined in the federal regulations as a device or technology that automatically records a driver’s driving time and facilitates the recording of the driver’s record of duty status, certified by an accredited certification body, and a motor carrier must ensure that each commercial vehicle it operates is equipped with one meeting the Technical Standard, subject to the listed exceptions. In British Columbia the same obligation sits in the provincial regulations: a carrier must ensure that each commercial motor vehicle it operates is equipped with an ELD that meets the requirements of the Technical Standard and is mounted in a fixed position.
You are also obliged to look at what it records. A motor carrier shall monitor the compliance of each driver with these Regulations, and where there has been non-compliance must take immediate remedial action and record the dates on which the non-compliance occurred and the action taken. Separately, the carrier must verify the accuracy of the certified records of duty status forwarded by the driver against the supporting documents and require the changes necessary to ensure accuracy — and the driver, not the office, either accepts or rejects the changes, makes them and recertifies the record.
You cannot quietly fix a log
The same regulations prohibit a carrier from requesting, requiring or allowing anyone to enter inaccurate information in a record of duty status or falsify, mutilate, obscure, alter, delete, destroy or deface the records or supporting documents, and from tampering with an ELD so that it does not accurately record and retain the data required. An integration that writes corrections back into a log without the driver’s recertification is on the wrong side of that.
Federally regulated carriers and their employee information sit under the federal private-sector privacy statute; the Office of the Privacy Commissioner keeps its guidance for employers on its employers and employees topic page, including material on privacy in the workplace and on mobile devices at work. The operative test is short: an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Consent has a quality standard attached — it is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure. And the data has to be looked after: personal information shall be protected by security safeguards appropriate to the sensitivity of the information, against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which it is held.
The practical consequence is that the fleet’s purpose statement does the work. “We record position, driving time and duty status because the hours-of-service regulations require it, and we review harsh-braking events for coaching” is a defensible pair of purposes. Adding a third use later — scoring drivers for a bonus, sharing a driver’s route history with a customer, feeding location into a productivity ranking — is a new purpose, and it needs to be named before it is used, not discovered in a policy afterwards.
The trigger is a headcount on a fixed date. Employers that employ 25 or more employees on January 1 of any year are required to have a written policy on the electronic monitoring of employees in place, and from 2023 onward that policy must be in place before March 1 of that year. The count is of individuals: part-time and casual employees each count as one employee regardless of hours, and where an employer has multiple locations all employees at each Ontario location are included.
The content is prescribed. The policy must state whether or not the employer electronically monitors employees, and if it does, must include a description of how and in what circumstances it may do so, the purposes for which the information obtained may be used, the date the policy was prepared and the date of any changes. Distribution and retention are prescribed too: a copy must be provided to employees within 30 calendar days, and the employer must retain a copy of every written policy for three years after the policy is no longer in effect. Treadstone’s sister law firm sets out the drafting requirements in its note on the Ontario electronic monitoring policy requirement.
An Ontario carrier employs 31 people on 1 January — 22 drivers, 4 shop, 5 office. Because 31 is at or above 25, a written policy must be in place before 1 March, and each employee must have a copy within 30 days of the later of the date the policy was required and the date they became an employee.
A neighbouring carrier employs 24 on 1 January and hires three people on 15 January. It is outside the requirement for that year, because the count is taken on 1 January and 24 is below the 25 threshold. It will be inside it the following 1 January if the headcount holds. Nothing about the second carrier’s telematics is different; only the transparency duty is.
Now the reuse question, which is where both carriers actually get into trouble. The first fleet wants to pay a quarterly safety bonus scored on harsh-braking events. The telematics data already exists and is lawfully collected. But the bonus is a new purpose, so it belongs in the policy’s statement of the purposes for which the information obtained through electronic monitoring may be used, and it has to survive the reasonable person test on its own terms — including the obvious objection that an event count without context penalises the driver who brakes hard to avoid a collision. Naming the purpose is the legal step; designing the measure so it is not perverse is the management step, and only one of those is optional.
Telematics produces far more events than anyone reads, and that is the tractable problem. Clustering events so a supervisor sees a pattern for one driver rather than 4,000 rows. Reconciling a certified record of duty status against fuel receipts, gate times and bills of lading so the carrier’s verification duty is actually discharged rather than assumed. Drafting the non-compliance notice and holding the record of the dates on which the non-compliance occurred and the action taken. Keeping the written policy versioned so the three-year retention obligation is met.
What it must not do is decide. Whether a driver is disciplined, whether a bonus is paid, whether a log entry is accurate, and whether a monitoring purpose is appropriate are human decisions with a name on them. The system assembles the evidence and shortens the search.
Nothing in the transparency rule prevents it — it does not establish a right for employees not to be electronically monitored. What matters is that using the data for performance management is one of the stated purposes in your policy, that the underlying collection meets the appropriate purposes test, and that the process itself is defensible. Take advice on the employment side before the first case, not after it.
The regulatory obligation explains the purpose rather than replacing the privacy analysis. Where the carrier is required to ensure each commercial vehicle is equipped with a certified ELD, that is a straightforward, explainable purpose. The care is needed for everything the same hardware collects beyond it — idle time, speed traces, personal conveyance movement — which needs its own stated purpose.
The policy must cover all employees, though an employer may have different policies for different groups of employees. A fleet that monitors trucks but not the accounts desk should say exactly that rather than writing one vague paragraph for everybody.
Three years after the policy is no longer in effect — which means superseded versions are kept, not overwritten. Version control is part of compliance here, not just tidiness.
A 30-minute call is enough to tell you whether AI pays for itself in your back office.
