Statement by the Privacy Commissioner of Canada to the House of Commons Standing Committee on Science and Research on its study on the Implications of the Canada-China Preliminary Joint Arrangement on Canada’s Electric Vehicle Sector

April 16, 2026
Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Madam Chair, members of the Committee. Thank you for the invitation to appear on your study on the Implications of the Canada-China Preliminary Joint Arrangement on Canada’s Electric Vehicle Sector.

As Privacy Commissioner of Canada, my mission is to protect and promote Canadians’ right to privacy. My mandate is to oversee compliance with Canada’s federal public and private-sector privacy laws, which set the ground rules for how federal government institutions and businesses handle personal information.

Many of the vehicles that Canadians now drive are connected to the Internet. This can offer significant convenience, such as real-time navigation, facilitated roadside assistance, and seamless integration with mobile devices.

These connected features also raise important privacy considerations. Modern vehicles collect and transmit large volumes of personal data – including location history, driving behaviour, and personal preferences – which also raises the issue of how this information is stored, shared, and protected.

In some cases, the data may potentially be transferred or stored in foreign jurisdictions, where different legal frameworks and data protection standards can increase the risk of access or use of personal information, including access by foreign courts, law enforcement, and national security authorities.

Data flows underpinning the connected vehicle ecosystem can be complex and opaque. This is why my Office has supported research into connected vehicles through our Contributions Program.

This year, the OPC has funded two related research projects, one that is evaluating the privacy permissions and releases that automakers are requiring of their Canadian customers in return for access to on-board features and connected applications in new cars, and another examining how privacy by design can be used to improve privacy protection when companies access identifiable information from connected vehicles. I anticipate that the results of this work will be published in the next few months.

Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA, does not contain separate and explicit rules governing trans-border data flows. PIPEDA currently requires that organizations be transparent about their data practices, which can include when personal information is transferred to a foreign jurisdiction and is accessible by their government, law enforcement, or courts.

The legislation also clarifies that organizations remain responsible for personal information that is transferred to a third party for processing and must ensure, through contractual or other means, that a comparable level of protection is provided.

I have recommended that PIPEDA be amended to specifically address trans-border data flows to ensure that Canadians’ personal information is appropriately protected prior to leaving the country. This could include requiring privacy impact assessments before data moves beyond Canada’s borders and providing for specific tools to ensure that data is afforded a comparable level of protection when it travels outside the country. This could be accomplished through, for example, standard contractual clauses, codes of practice, and certification programs.

My Office also works closely with our international counterparts to help advance trusted, safe, and secure cross-border flows of personal information.

This is one of my priorities as the newly elected chair of the Global Privacy Assembly, and it is also a pillar of my work with my counterparts in the G7 Data Protection and Privacy Authorities Roundtable. Last December, the Roundtable released a position paper on developing a strategic approach to the concept of data free flow with trust and I look forward to continuing this important work under the French G7 presidency this year.

My Office also supports the exploration of data transfer mechanisms that can provide businesses with regulatory certainty and that Canadians can trust, such as the Global Cross-Border Privacy Rules (CBPR) Forum certifications.

Privacy is, and must remain, a priority as we explore the implications of technology, to ensure that appropriate safeguards are in place to enable responsible innovation and protect Canadians’ personal information.

Thank you, and I look forward to your questions.