Privacy and discretion, in one paragraph
The trade's rule is what happens in the car stays in the car: the chauffeur's conduct (silence unless spoken to, no questions about the passenger's business, no comments, no recognition of a famous face, no photographs, no social media, no gossip at the depot — the chauffeur vs driver article's standard), the data (the trip record kept for the bylaw's and the tax's periods, seen by dispatch and the account holder, disclosed to a court order or a warrant and never to a spouse, an employer who is not the account holder or a journalist; the telematics used for safety and never sold; the passenger's rights under PIPEDA), the NDA (the corporate, entertainment and sports accounts' agreements signed by every chauffeur), the vehicle (the tinted glass, no branding, the partition in the stretch and the Sprinter, the coded sign at the airport), the routine (the regular's schedule known to the fleet and no one else), the famous passenger protocol (TIFF, the athletes, the politicians), the sensitive trip (the hospital, the lawyer, the clinic, the meeting), and the chauffeur's own privacy; a passenger can ask for a code name, a specific chauffeur, a female chauffeur, a partition, a side door, a route that avoids a street, and silence, and the what makes a car a black car article counts the discretion as part of the definition.
Discretion is the reason the trade exists at the top end: a rideshare driver can post the celebrity's photo, a taxi driver can tell the next fare who was in the back, and neither has signed anything; a chauffeur has signed the fleet's confidentiality agreement and the account's NDA, has been vetted for the temperament, and knows that a single breach ends the career — which is why the banks, the studios, the teams, the law firms and the families who need it book black cars and ask for the same chauffeur. This guide writes the unwritten rules down: the rule itself, the conduct, the data and who sees it, the law, the NDA, the vehicle, the routine, the famous passenger, the sensitive trip, the chauffeur's own privacy, what a passenger can ask for, the breaches and their consequence, and a worked week of discretion.
The rule
What happens in the car stays in the car: who rode, where they went, what they said, who they were with, what they carried, how they looked, what they did on the phone, where they stopped, whom they met at the door — none of it leaves the vehicle except into the fleet's trip record (the minimum the bylaw and the account require) and the chauffeur's memory, which is closed. The rule is older than the trade's licences (the household chauffeur of 1910 kept it), it is the first thing the vetting article's interview tests for, and it is the one rule whose breach is dismissal without a second chance.
The conduct
Silence unless spoken to: the greeting, the destination, the one question at the first light, and then nothing — the passenger who wants conversation starts it and the chauffeur follows their lead and stops when they stop. No questions about the passenger's business: not "big meeting?", not "flying somewhere nice?", not "is that your daughter?" — the chauffeur asks about the trip and nothing else. No comments: on the passenger's appearance, mood, companion, phone call, destination or choices. No recognition: a famous passenger is greeted as any passenger — by the name on the booking (often a code name), with no "I loved your last film," no autograph, no mention to the next passenger. No photographs: of the passenger, the vehicle with the passenger in it, the destination, the companion — ever, on any device. No social media: no post, no story, no "guess who I drove," no location tag during a shift. No gossip at the depot: the chauffeurs' room has its own rule — the trip is not discussed, the passenger is not named, and a chauffeur who does is spoken to once. No carrying of messages: between the divorced parents, between the executive and the assistant, between anyone. The eyes forward and the mirror for the road. The women travelling alone article makes the conduct's safety dimension explicit.
The data: what is kept, who sees it
The trip record (Toronto limousine licensing article): the booking's time, the passenger's name or the account's traveller, the pickup and the destination, the time, the vehicle, the chauffeur, the fare — kept for the bylaw's period (the City requires the brokerage to keep trip records for inspection) and the Canada Revenue Agency's (seven years for the invoice), in the brokerage's system, seen by dispatch and the accounting staff who need it and by the account holder on the statement. The telematics (passenger safety article): the vehicle's location, speed and events — kept for the safety review period (the fleets keep 90 days to a year), used for the smoothness score, the incident investigation and the passenger's own complaint, and never sold, shared with a marketer or used to profile a passenger. The profile (in-car amenities article): the preferences, the addresses, the children's stages — kept while the account is active, deleted on request. The chauffeur's memory: closed. What is not kept: the conversation (no recording in the vehicle — the fleets do not run in-cabin audio or video except the forward-facing dash camera some run for collisions, which does not record the cabin), the companion's identity, the phone's contents, the bags' contents.
The law
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs the fleet's collection, use and disclosure of a passenger's personal information — the consent (the booking is the consent to the trip record and the profile), the purpose limitation (the record for the trip, the billing and the bylaw; the telematics for safety), the retention (no longer than the purpose needs), the safeguards (the brokerage's system's security), the access right (a passenger may ask what the fleet holds about them and have it corrected), and the disclosure rules — the fleet discloses a passenger's record only to the passenger, to the account holder who paid for the trip (the employer sees the employee's business trips on its statement — the corporate account billing article says what and the executive assistants' guide says how), to a court under a valid order, to the police under a warrant or as the law compels (a production order; the limo accident article's collision report), and to the City's bylaw officers for the bylaw's inspection; and never to a spouse or a partner who is not the account holder, to an employer who did not pay for the trip, to a journalist, to a private investigator, to a "friend" who calls, or to anyone who cannot prove the legal right. The Office of the Privacy Commissioner is the regulator and the fleet's privacy policy is on its site.
The NDA
The corporate accounts': the bank's, the law firm's, the consultancy's non-disclosure agreement, signed by every chauffeur on the account's roster, covering the client's people, deals, documents (the pitch books in the trunk), conversations and destinations — the roadshow article's bankers and the visiting clients itinerary article's guests ride under it. The entertainment and sports clients': the studio's, the festival's, the team's and the league's agreements for the TIFF talent, the film and TV production's cast, the Raptors and the Leafs' players and the visiting teams (the Scotiabank Arena guide), the concert's artists (the concert article) — no photographs, no social media, no disclosure of the hotel, the schedule or the companion. The fleet's own: every chauffeur signs the fleet's confidentiality agreement at hiring — the rule above in a contract, with the dismissal clause. The government's: the security clearance the vetting article describes for the diplomatic and the defence accounts.
The vehicle
The what makes a car a black car article's anonymity: tinted rear glass to the legal limit (the Ontario HTA rules article), the rear sunshades and side blinds in the S-Class, no fleet name on the doors, no dealer badge, the small permit decals only, the partition in the stretch and the executive Sprinter, the coded sign at the airport (a first name, an initial, a company's project name, a word the passenger chose), the side door at the hotel (the Financial District hotels guide's and the Four Seasons' staff entrances for the passenger who does not want the porte-cochère), the loading dock at the arena and the studio, and the TIFF guide's back-of-house lanes.
The routine
A regular passenger's schedule — the 6 a.m. Pearson run every Monday, the Thursday dinner at the same restaurant, the Friday afternoon to the cottage, the weekly appointment on hospital row, the child's school run — is known to dispatch and the regular chauffeur and to no one else; the fleet's staff do not discuss a passenger's pattern, the profile is access-controlled to the dispatchers who need it, and a caller who asks "when does Mr. X usually travel?" gets nothing. The corporate account billing article's statement shows the account holder its own trips and no one else's, and the executive assistants' guide's assistant sees the executive's bookings under the account's permissions.
The famous passenger
The protocol, learned over twenty TIFFs: the booking under a code name (the studio's or the publicist's), the chauffeur briefed on the name to use and nothing else, the greeting as any passenger, no recognition, no request, no photograph, no mention to anyone including the chauffeur's family, the vehicle's tint and the side door, the publicist's or the security detail's instructions followed to the letter, the route that avoids the photographers' corners (the chauffeur knows them), the wait where instructed, the NDA signed, and the trip record under the code name; the athletes and the visiting teams (the Scotiabank Arena guide's player lane), the politicians (the Queen's Park and the federal ministers' Toronto days, with the security detail's protocol), the executives whose faces are on the business pages (the Financial District hotels guide's side doors), and the passenger who is famous only to the chauffeur — all the same protocol.
The sensitive trip
The trips a passenger does not want seen: the hospital row's oncology appointment and the Princess Margaret's door (the chauffeur drops at the entrance the passenger names and waits where the passenger cannot be seen getting in), the fertility clinic, the addiction treatment centre, the psychiatrist's office, the divorce lawyer's (the funeral article's standard of nothing said), the meeting at a competitor's office, the interview at another firm, the proposal's secret and the date night's surprise, the same-sex partner in a country that would punish it, the pregnancy not yet announced, the private aviation flight that does not appear on a schedule; the chauffeur takes the passenger where they ask, waits where they ask, and the trip record says the address and nothing about the purpose. A passenger who wants the destination recorded as a cross street rather than a building says so.
The chauffeur's own privacy
The chauffeur's full name is not given to the passenger by default (the first name and the initial — the passenger safety article's text), their home address and their phone number never; contact runs through dispatch; a passenger who wants the chauffeur's number is given dispatch's and the chauffeur is asked before their first name is shared beyond the initial; the women travelling alone article's no-numbers rule runs both ways; and the becoming a chauffeur article says the trade protects its chauffeurs from the passenger who will not take no.
What a passenger can ask for
A code name on the booking, the confirmation and the airport sign; a specific chauffeur or a female chauffeur (the in-car amenities article's requests); a partition (the stretch or the executive Sprinter); a side door at the hotel, the office or the venue; a route that avoids a street or a corner; the destination recorded as a cross street; silence (the profile's default); no music, no news; the blinds down; no text to anyone but the passenger (the corporate account's notifications to the assistant turned off for a trip); the profile deleted when the account closes; and a copy of what the fleet holds about them under PIPEDA's access right. Dispatch says yes to all of them.
The breaches and their consequence
A photograph posted, a name mentioned at the depot, a question about the passenger's business, a comment on the companion, a message carried between parents, a record disclosed to a caller, a location tagged — each is a breach of the fleet's confidentiality agreement and, on the accounts, of the NDA; the consequence is removal from the road the same day, dismissal on confirmation, the account's notification, and — for an NDA breach — the client's remedies; the fleet's history has a handful and every chauffeur knows the names. The cheap limo service article describes the operator with no agreement to breach.
A worked week of discretion
A chauffeur's week in September. Monday: a bank's roadshow team, the pitch books in the trunk, the NDA; the chauffeur hears the target's name four times and forgets it. Tuesday: a TIFF actor under a code name from the Ritz's side door to a Roy Thomson Hall back lane; the chauffeur's teenager asks at dinner who he drove; "a passenger." Wednesday: a regular to hospital row for the third Wednesday running, dropped at the entrance she names, collected at the corner she names; the record says "610 University." Thursday: a divorced parents' exchange; the father asks how the mother seemed; "she was ready at the door, sir." Friday: a couple to a Bluffs lookout — the proposal — and a call from the bride's sister on Saturday asking dispatch what time they got to the restaurant; dispatch: "we don't share trip details." Saturday: a wedding; the groom's brother offers the chauffeur $100 to say where the couple's hotel is; no. Sunday: off. Six trips, six things known, zero said.
Privacy and discretion quick reference
| Element | The rule |
|---|---|
| The principle | What happens in the car stays in the car |
| Conduct | Silence unless spoken to; no business questions; no comments; no recognition; no photos; no social media; no depot gossip; no messages carried; eyes forward |
| The trip record | Booking time, name / account, pickup, destination, time, vehicle, chauffeur, fare — kept for the bylaw's and the CRA's periods; seen by dispatch, accounting and the account holder |
| Telematics | Location, speed, events — kept 90 days to a year for safety; never sold or used to profile |
| Not kept | The conversation (no cabin recording); the companion; the phone; the bags |
| Disclosure | To the passenger; the account holder who paid; a court order; a warrant / production order; the City's inspector — never a spouse, a non-paying employer, a journalist, an investigator or a caller |
| The law | PIPEDA — consent, purpose, retention, safeguards, access, correction; the Privacy Commissioner |
| The NDA | The corporate, entertainment, sports and government accounts'; the fleet's own confidentiality agreement; dismissal on breach |
| The vehicle | Tint; blinds; no branding; the partition; the coded sign; the side door; the back lane |
| The famous | A code name; the greeting as anyone; the publicist's or security's instructions; the photographers' corners avoided |
| The sensitive | The named entrance; the wait out of sight; the record as a cross street on request |
| Ask for | A code name; a chauffeur; a partition; a side door; a route; a cross-street record; silence; blinds; notifications off; deletion; your data |
Booking with discretion
The engine's notes take the code name and the side door; the corporate account holds the NDA and the roster; the Pearson page books the coded sign; the hourly chauffeur page books the day with one chauffeur. What happens in the car stays in the car.
