Investigation into Trimac’s use of an audio and video surveillance device in its truck cabins

PIPEDA Findings # 2022-006

July 27, 2022

---

Complaint under the Personal Information Protection and Electronic Documents Act

Report of findings

Overview

The complainant, a truck driver employed by Trimac Transportation Services Inc. (“Trimac”), claimed the organization installed a dash camera into his vehicle that continuously recorded audio and video without his consent. The complainant was particularly concerned with the organization’s recording of audio.

Our investigation focused on whether Trimac’s purpose for collection and use of drivers’ personal information via a dash camera system’s (“the System”) audio functionality, which was active whenever the truck was on, even when the driver was off-duty and not driving, was appropriate in the circumstances. We found that the System was not implemented for an appropriate purpose, in the circumstances. We accepted that Trimac had a legitimate need for implementing the System, including to ensure road safety, and that the System was likely to be effective in achieving those objectives. However, Trimac could have achieved the same ends in a less privacy intrusive way. Further, the loss of privacy resulting from Trimac’s implementation of the System was not proportional to the benefits Trimac hoped to gain. We consequently recommended that Trimac: (i) limit the audio functionality capabilities of the System to be active only when a driver is on-duty and/or driving; and (ii) technologically limit access to the personal information captured by the System to only those employees who “need to know” for Trimac’s purposes. Trimac agreed to implement all our recommendations such that we find this aspect of the complaint to be well-founded and conditionally resolved.

Our investigation also examined whether Trimac required the consent of its employees to collect their personal information in the circumstances. We found that Trimac could not, initially, rely on the exception to consent provided for in section 7.3 (relating to employment relationships) of the Personal Information Protection and Electronic Documents Act (“PIPEDA” or ‘the Act’) in that it was not initially transparent about its collection and use of personal information for disciplinary purposes, as required by section 7.3. However, owing to remedial actions taken to explain these purposes to employees, we found that Trimac can now rely on this exception to consent. We therefore find this aspect of the complaint to be well-founded and resolved.

Background

1. The complainant, a truck driver employed by Trimac Transportation Services Inc. (“Trimac”), claimed the organization installed a dash camera into his vehicle that continuously recorded audio and video without his consent. The complainant was particularly concerned with the organization’s recording of audio.
2. Trimac, one of the largest transportation service companies in North America, provides wide-ranged bulk delivery services over short and long hauls. Prior to our receipt of the complaint, the company deployed a dash camera system (the “System”) in its employees’ truck cabins, including that of the complainant. Trimac explained that it deployed the System to protect the company’s assets and “ensure the safe operation of company trucks”. Trimac supported its claim with statistical data, including on accident numbers and resulting losses, illustrating why it needed to take action to improve the safety of its operations.
3. At issue in this case is the collection of personal information via the use of a dash camera system capturing forward facing video and audio within Trimac truck cabins. The System consists of a small device installed on the truck’s interior windshield, which was, at the time of the complaint, continuously active when the truck was turned on, regardless of whether the truck was being driven, or whether the driver was on or off duty.^{Footnote 1}
4. The device also captures various signals similar to Advanced Driver-Assisted Systems signals and associated events; including in relation to high G-Force and truck speed. The System has built in technology and logic that physically measures when a truck has a “stability event”, is following too close to another vehicle, or when it inadvertently departs from its designated lane.
5. If and when these types of events take place, there is an audible signal in the truck to alert drivers that they should modify their driving behavior (for example by increasing their following distance or maintaining their lane). Events identified as risky driving behaviors^{Footnote 2} also trigger the retention of a twelve second clip (including audio and video). The clip captures 8 seconds before the event and 4 seconds after. A third-party processor then audits the clips to help classify the event. Events are classified as either accidents, coachable events or “FYI only” clips (i.e., clips where no accident or coachable events have been identified).
6. The third-party processor then makes available the categorized clips to Trimac through a portal (the “portal”). The portal is divided by region and branch, and is accessible to approximately 150 Trimac employees. Accidents and coachable events clips are flagged to Trimac’s managers for review and appropriate follow-up action. “FYI only” clips are reviewed by management, on an as needed basis only. If a clip is considered a coaching opportunity, the driver will be provided a copy of the clip in order to self-coach. That said, at the time the complaint was received, all clips within a branch or region were also available to all portal users within that branch or region, for 90 days, via the “View All” tab of the portal. Users were instructed not to access this tab.
7. Trimac explained that it installed the System for the purposes of: (i) proactively preventing injuries and collisions; (ii) safety management, coaching, training, and improving driving skills; (iii) protecting drivers, Trimac and Trimac property; (iv) investigating and determining the true cause of road accidents; (v) exonerating drivers in the event of false claims; (v) managing employee performance through coaching, additional training, and progressive discipline; (vi) ensuring Trimac’s compliance with contractual obligations and road safety laws and standards; and (vii) assisting in litigation and claims. For ease of reference, for the purpose of this investigation, we will categorize the above-noted purposes as road safety, asset protection, and employee performance management.
8. Considering the complainant was particularly concerned with the capture of audio recordings in the cabin, our investigation focused on the collection of personal information via that functionality of the System, as it was deployed at the time of the complaint.

Analysis

Issue 1: Are road safety, asset protection and employee performance management appropriate purposes for the collection of audio in the cabin of trucks via the System?

9. As a preliminary note, we based our analysis below on the fact that, at the time the complaint was received, the System was active when the truck was on or idling; noting the system could therefore be active when drivers are off duty (for instance, when a driver rests in his cabin and the truck is idling). We also considered that the System, when on, continually records audio in the cabin so that it could capture and retain, when triggered, 8 seconds of data prior to an event.
10. For the reasons that follow, we are of the view that the System, as deployed at the time of the complaint, was disproportionately privacy intrusive. While we appreciate the importance of Trimac’s purposes, particularly as they relate to road safety, and while we recognize that the System could be effective in meeting those needs, we are of the view that the continual activity of the System, including when drivers are off duty and not driving, is not required to meet Trimac’s purposes. The resulting harm to the privacy of drivers is disproportionate to the System’s benefits, where: (i) drivers are subject to being recorded when they are off duty and not driving; and (ii) retained clips are available to more Trimac employees than necessary with limited safeguards against unauthorized access.
11. In making our determination on the appropriateness of Trimac’s purposes for collecting personal information via the System, we considered subsection 5(3) of the Act which states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
12. In accordance with our Office’s Guidance on inappropriate data practices: interpretation and application of subsection 5(3), in addition to considering the degree of sensitivity of the personal information at issue, we consider the factors set out by the courts in order to assist in determining whether a reasonable person would find that an organization’s collection, use and disclosure of information is for an appropriate purpose in the circumstances. Specifically, we consider:
    1. Whether the organization’s purpose represents a legitimate need / bona fide business interest;
    2. Whether the collection, use and disclosure would be effective in meeting the organization’s need;
    3. Whether there are less privacy invasive means of achieving the same ends at comparable cost and with comparable benefits; and
    4. Whether the loss of privacy is proportional to the benefits.

Sensitivity of the personal information collected

13. The personal information captured by Trimac via the dash camera system would include drivers’ conversations that occur within the cabin of their trucks as long as the truck is on, even when they are off duty and not driving. As drivers spend a lot of time in their truck, which can serve as their temporary home while on the road, conversations captured can include private information exchanged with their relatives, friends, doctors or other third parties. Therefore, we are of the view that the System collects sensitive personal information.

Legitimate need or bona fide business interest

14. As discussed above, Trimac’s purposes for the use of the System can be summarized as road safety, asset protection and employee performance management.
15. Consistent with previous findings of our Office^{Footnote 3}, we accept Trimac has a legitimate need to ensure public safety, protect its assets, and supervise and manage its employees.

Effectiveness

15. Trimac explained that clips collected via the System might include evidence of driver road rage, a driver talking on the phone and therefore being distracted, or the sound of a collision, squealing tires, etc. Trimac indicated that the number of unsafe events is trending downwards since implementation of the System. Trimac cited a 62.5% coaching effectiveness score, meaning that 62.5% of the time a driver has an unsafe behaviour identified, they do not repeat that same behaviour in the next 60 days.
16. In light of the above, we accept that the System can be effective in meeting Trimac’s needs.

Less privacy invasive means

18. Trimac asserted that the System’s intrusiveness is limited because the System only saves 12 second clips, and only when triggered by events recognized to be associated with a safety risk. Trimac supports its claim with statistics indicating recorded clips represent, on average, only 1% of drivers’ driving time.
19. Where we accept that by virtue of taking “clips”, the total volume of footage retained is limited relative to the drivers’ total time in the truck, we nevertheless find the System to be more intrusive than necessary, in that its active use when a driver is off duty and not driving is not required to meet Trimac’s purposes.
20. It is our understanding that the collection of audio during off-duty hours would occur only in the event of a collision while the truck is parked and idling. In those circumstances, we fail to see how the in-cab audio recording would be necessary for Trimac’s purposes. Where Trimac suggested the audio could serve to detect the location, on the truck, of a collision, we are rather of the view that it would have limited, if any, value for this purpose. Furthermore, Trimac could rely on other signals captured by the System to be alerted of a collision and its potential location, when the truck is idling and the driver is off duty. We also note that the audio recording could not serve to coach the employee in such circumstances, as the employee would have been off-duty and not driving.
21. In addition, clips were, until recently (as discussed further below), accessible to more Trimac employees than necessary, via the portal’s “View All” tab. Considering the potentially sensitive information that can be captured in those clips, access to the clips should be strictly limited to those employees who “need to know”, rather than by all employees who have access to the portal in that branch or region. For example, “need to know” persons could include: coaching managers, the employee concerned, and investigators looking into an accident. Further, regarding the potential for unauthorized access to the “View All” tab, Trimac’s practice of simply instructing its employees “not to look at this view” was an inadequate safeguard. No technological safeguards were in place to prevent access through the “View All” tab by portal users to clips they had no need to view.
22. Ultimately, it would be less privacy intrusive for the audio recording functionality to be active only when a driver is on-duty and/or driving, and for the clips transferred to Trimac to be technologically safeguarded from access by those who do not need to view the clips.

Proportionality

23. Given the importance of Trimac’s purposes, particularly as they relate to safety, we accept that the benefits of collecting and using drivers’ information, while they are on duty and/or driving, would be proportional to the loss of privacy. However, in our view, the collection of drivers’ potentially sensitive personal information when they are not driving and off-duty, which may include while they are resting or even sleeping in their truck’s sleeper cab (which one could describe as their bedroom), is highly intrusive. The resulting impact on drivers’ privacy was, based on the System’s implementation at the time of the complaint, disproportionate to the benefits the company hoped to gain.
24. Consequently, given that there was a less privacy intrusive means of achieving Trimac’s objectives, and the loss of privacy was disproportionate to the benefits Trimac hoped to gain from the System, we find that Trimac contravened subsection 5(3) of the Act.

Recommendations and Trimac’s response

25. With a view to addressing the privacy intrusiveness of the System as it relates to the collection of personal information via its audio recording functionality, we recommended that Trimac:
    1. Limit the audio recording function of the dash camera system to drivers’ on-duty hours and instances where they may be off-duty but driving; and,
    2. Limit access to the clips transferred to and retained by Trimac under the ‘View All” tab using technological safeguards.
26. In response to our recommendations, Trimac explained that, until recently, it was not possible to limit the audio recording function of the System to drivers’ on-duty hours. The System turned on when the ignition was turned on.
27. However, subsequent to the receipt of our preliminary findings and recommendations, Trimac confirmed its implementation of a new function of the System to further limit the capture of audio. As of 11 March 2022, Trimac deployed, via a software update on all Systems installed in its Canadian fleet, a ‘Sleep Mode/Privacy mode’ function whereby the microphone of the camera will shut off:
    1. five minutes after the ignition is turned off;
    2. after 15 minutes of idling; or
    3. immediately once the parking brake is detected.
28. Similarly, Trimac also advised that the ‘View All’ tab was removed from the portal. In addition, Trimac represented that only two individuals within the company have access to all views and functionalities of the portal: the Vice President of Safety and the Director of Safety.
29. Further, Trimac agreed that access to the clips should be strictly limited to those employees who ‘need to know’. As such, Trimac conducted an audit of the 151 individuals initially having access to the portal and have since further limited access rights.
30. Finally, Trimac agreed to develop and implement an internal standard procedure to structure how access to the clips is to be granted and the frequency of monitoring activities. It has undertaken to provide a copy of that document to our Office by 31 July 2022.
31. In light of the above, our Office finds this aspect of the complaint to be well-founded and conditionally resolved.

Issue 2: Was employee consent required for the collection of personal information via the System?

32. Trimac could potentially rely on the exception to consent provided under subsection 7.3 of the Act because the personal information at issue is collected and used in the context of the employment relationship. However, Trimac was not initially transparent about the disciplinary purposes of its dash camera system and was therefore contravening the Act until it rectified the situation.
33. Principle 4.3 of Schedule 1 of PIPEDA states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
34. Subsection 7.3 of the Act provides that for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, a federal work, undertaking or business may collect, use and disclose personal information without the consent of the individual if:
    1. the collection, use or disclosure is necessary to establish, manage or terminate an employment relationship between the federal work, undertaking or business and the individual; and
    2. the federal work, undertaking or business has informed the individual that the personal information will be or may be collected, used or disclosed for those purposes.
35. Where we accept that Trimac’s collection and use of personal information via the audio functionality of the dash camera system is necessary to manage its employment relationships when drivers are on-duty or driving (consistent with our findings above), Trimac did not, initially, fully identify all of the purposes for its use, in particular that the information captured by the System could be used for disciplinary purposes. It could not, therefore, rely on the exception to consent in section 7.3.
36. In the course of our investigation, Trimac provided our Office with various communications materials issued to Trimac’s drivers prior to and during the launch of the System. We reviewed memoranda, emails and presentations provided to Trimac’s employees at various points in time. We found that Trimac’s initial communications were focused on introducing the System’s functionalities, and provided little information about the System’s purposes, focusing on the fact that it was aimed at protecting the drivers.
37. Trimac’s external legal counsel had identified that this was an issue needing to be addressed. In an email provided to the complainant by Trimac and further shared by the complainant with our Office, Trimac’s legal counsel advised, in regard to the exception to consent found in subsection 7.3 of the Act, that:

    “The main issue is that the company does not appear to have informed its employees that the data from the truck mounted cameras may be collected, used and disclosed for disciplinary purposes, or for purposes of terminating the employment relationship. We therefore recommend that the company develop and circulate a policy, or notice to the employees that clearly states the uses for the audio and video data, including “disciplinary purposes and for terminating the employment relationship.” [Our emphasis]

38. Ultimately, it was not until approximately two years after the implementation of the System and 6 months after receiving the above advice, that Trimac issued clear written guidance informing its drivers of the System’s potential use for the purposes of progressive discipline.
39. As a result, we find that Trimac could not rely on the exception to consent provided for in section 7.3 and contravened Principle 4.3 in that it did not initially obtain informed consent for the collection and use of the personal information of its drivers via the System. However, we are of the view that Trimac can now rely on the exception to consent found in section 7.3 as it has since clearly notified its employees of the employment management and related disciplinary purposes associated with information collected by the dash camera system. We therefore find this aspect of the complaint to be well-founded and resolved.