Even Quebec’s Ethics Commission Couldn’t Figure Out Where Your Car Data Goes

• Quebec’s privacy regulator considers vehicle geolocation data impossible to anonymize

• Passengers and pedestrians are recorded by car cameras without consent

• Proprietary software and locks restrict which garages can repair modern vehicles

---

The Commission de l’éthique en science et en technologie (CEST), an advisory body to the Quebec government, has published a report mapping the privacy, consent, surveillance and repair issues raised by connected vehicles. Érika Olivaux, an ethics advisor at the CEST who worked on the report, discussed its findings on a recent episode of Mon Carnet, the digital-news podcast hosted by Bruno Guglielminetti.

The report describes today’s vehicles as “computers on wheels.” Its central finding is that the flow of data leaving those vehicles is difficult to follow, even for the people studying it. “It was even difficult for us to know the state of the data flows,” Olivaux said.

Geolocation data cannot be anonymized, Quebec’s privacy regulator says

Olivaux named location data as the most sensitive category a vehicle collects. She pointed to the position of the Commission d’accès à l’information, Quebec’s privacy regulator, that geolocation data cannot be de-identified. Her example: think about how many people make your exact daily trip between home and work.

She added that data which looks harmless on its own, such as driving habits or a calendar synced from a phone, becomes sensitive once assembled with everything else. The CEST therefore looked at the whole ecosystem rather than individual data points.

Cameras and microphones capture people who never agreed to anything

Here is where the report reaches beyond the driver’s seat. Driver-monitoring cameras, exterior cameras and voice-command microphones collect images and audio inside the cabin and on public roads. A driver may have read the privacy policy, Olivaux said, but passengers are rarely informed, and pedestrians have no way of knowing they are being filmed.

Quebec’s reformed privacy law and federal PIPEDA leave a gap

Quebec modernized its private-sector privacy law in recent years (Law 25). Olivaux said that regime rests on informational self-determination: each person decides what happens to their data. She called the model insufficient for connected cars, for two reasons. The power imbalance between individuals and data-collecting companies is large, and buyers have no non-connected option. “I can choose the non-connected version” of a coffee maker or a vacuum, she said. “For cars, there is a problem of choice.”

Automakers doing business across Canada and internationally fall mainly under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which she said has not been modernized in a long time and is not adapted to current digital practices. She noted a federal reform project is now on the table.

Decline the policy and lose features; policies too long or too vague

Consent in a connected car comes with a trade-off: refuse the terms and some vehicle functions disappear. Olivaux, who read the automakers’ privacy policies herself, said they tend to be either long and hard to read or short and vague. Good practice, she said, would state the purpose behind each category of data collected, rather than listing every data type and every possible use in one block.

Proprietary software limits where owners can get repairs

The report also covers repairability. Proprietary software, digital locks and restricted diagnostic access mean not every garage can service a modern vehicle, and Olivaux said current legislation tends to protect those restrictions under copyright and competition law rather than an owner’s right of use and choice of mechanic. She referred listeners to an opinion published by the Union des consommateurs on the subject.

Electronic components are also costlier and more complex to repair than mechanical parts, she added, which carries an environmental cost.

No recommendations, but one priority: find out where the data goes

The CEST report maps issues; it does not make recommendations. Asked what a single government priority should be, Olivaux said Quebec first needs an accurate picture of what happens to vehicle data, including the role of data brokers trading datasets that are “more or less sensitive, more or less de-identified.” Only then, she said, can regulators act in the right places.

The full interview is available on Mon Carnet, l’actu numérique.