PIPEDA — the Personal Information Protection and Electronic Documents Act — tends to get discussed in the context of customer data and payment processing. Trucking companies don’t immediately think of themselves as organizations with significant personal information obligations.
They should.
A carrier running ten trucks collects GPS location data on ten people every working day. It holds medical certificate details for every driver. It has payroll records, bank account information for direct deposit, driver abstracts pulled from provincial registries, and possibly ELD data showing hours-by-hours driving patterns over months or years.
All of it is regulated.
What Counts as Personal Information in a Fleet Context
Under PIPEDA, personal information is any information about an identifiable individual. For a trucking carrier, that includes:
Location data. GPS coordinates generated by a driver app or in-cab device. Real-time and historical location of an identified person is personal information. Full stop.
Medical information. Medical certificate details — including the examining physician, any licence restrictions, and renewal dates — are among the most sensitive categories of personal information under Canadian privacy law.
Financial records. Pay rates, direct deposit banking details, tax information. All personal information.
Driver abstracts. A provincial driving record obtained from a government registry is personal information obtained from a third party. It can be collected and used for employment purposes, but it’s regulated.
Performance data. Hard braking events, speeding incidents, idle time, delivery timestamps — if they’re tied to an identified driver, they’re personal information.
Identity documents. CDL number, date of birth, address, licence class. The basic driver profile.
The Four Obligations That Matter
Consent and disclosure. You need the driver’s knowledge and consent to collect, use, and disclose their personal information. For employment relationships, this is typically handled in the employment agreement or owner-operator agreement. The consent needs to be meaningful — the driver should understand what’s being collected, why, and who sees it.
For GPS tracking specifically: if you track driver location during working hours, this needs to be disclosed. The employment agreement or onboarding documentation should state clearly that location tracking is active during trips. Tracking outside working hours — during rest periods, personal time, or off-duty days — is a different matter and requires careful justification.
Limiting collection to what’s necessary. You can collect personal information for identified purposes. You can’t collect it broadly for unspecified future uses. If you’re collecting driver performance data for safety monitoring, you can’t use that same data for unrelated purposes.
Retention limits. Personal information should be kept only as long as necessary for the identified purpose, then destroyed securely. Payroll records need to be kept for tax purposes (generally 7 years). A driver’s daily GPS logs from three years ago likely don’t need indefinite retention. Define your retention policy and apply it consistently.
Appropriate safeguards. The security measures protecting personal information should match the sensitivity of the data. Medical certificate information and payroll records require stronger protection than delivery completion records.
The practical gap most carriers have: The information gets collected at the start of the relationship and then just accumulates. No retention policy, no deletion process, no documented consent. That’s manageable risk when nothing goes wrong. It becomes a real problem when something does.
GPS Tracking: The Specific Considerations
Real-time GPS tracking during working hours is standard practice in Canadian trucking and is generally permissible under PIPEDA with proper disclosure. The issues that create compliance exposure:
Tracking during rest periods. If your driver app or ELD continues logging location during mandatory off-duty time, you’re collecting location data for periods where there’s no operational justification. Either configure your system to stop logging during rest, or be prepared to justify why the data is necessary.
Data retention for historical GPS. How long do you keep GPS logs after a trip is complete? Define a retention period — 90 days, 12 months, whatever your policy specifies — and then delete.
US-hosted software. If your fleet management software or TMS is hosted in the United States, your drivers’ location data and personal information may be subject to US law enforcement access under US law in ways that wouldn’t apply under Canadian hosting. For PIPEDA compliance, knowing where your data lives and having a data processing agreement with your vendor is the baseline.
What Happens When Something Goes Wrong
PIPEDA enforcement is handled by the Office of the Privacy Commissioner of Canada. Individuals can file complaints; the OPC investigates and can publish findings naming the organization publicly. Published findings are searchable and permanent.
Alberta and BC operate under provincial privacy legislation (PIPA) that applies to employee information. Quebec’s Law 25, significantly strengthened in recent years, includes fines up to 4% of worldwide revenue for serious violations.
The carrier-relevant violations that show up in OPC findings:
Collecting GPS location without adequate disclosure. Several published findings address employer location tracking without clear consent or documentation.
Retaining former employee records beyond necessary periods. Driver records from employees who left years ago need to be purged on a documented schedule.
Sharing driver information without consent. Providing a driver’s personal information — address, medical details, employment records — to a third party without consent is a violation.
Practical Steps
Update your employment and owner-operator agreements. They should describe what personal information is collected, why, and the carrier’s right to use GPS tracking during working hours.
Write down your data retention policy. How long do you keep GPS data, payroll records, driver abstracts, medical certificate copies? Write it down. Apply it.
Know where your data lives. Ask your TMS and ELD vendors where driver data is hosted and what data processing agreements exist. Canadian hosting is the cleanest path.
Train the person who handles driver records. The dispatcher or office manager handling driver files day-to-day should understand what can and can’t be shared, and who has access to what information.
How CyVeR Handles Driver Data
CyVeR is hosted in Canada on Canadian infrastructure. Driver personal information — GPS location data collected during active trips, medical certificate details, licence records, and pay records — is stored and processed in Canada.
Role-based access control means only users with the appropriate role can view sensitive driver information. A dispatcher sees trip assignments and GPS. An accountant sees pay records. Drivers access only their own trip information through the mobile app.
GPS location is collected during active trips and retained per the trip record for dispatch and billing purposes. The platform includes data export and deletion capabilities for individual driver records, supporting your obligations when a driver leaves your fleet.
Privacy and PIPEDA-aligned data handling are part of all CyVeR plans.