The Privacy Commissioner of Canada and the Information and Privacy Commissioners of Alberta and British Columbia have released new guidance urging retailers not to limit the collection of driver’s license data. In the press release accompanying the guide, the commissioners revealed that all three have received many complaints about retailers requesting driver’s licence information.
The commissioners noted that licenses are increasingly being used to prove identity, though that is not the purpose of driver’s licenses.
Over time, the driver’s licence has come to be used by many retailers as a reliable document to verify identity. Many organizations and individuals in fact treat the driver’s licence as a universal identity card by asking to see it and by recording information from it when individuals make purchases, return items or rent equipment.
The purpose, however, of a provincial driver’s licence is to demonstrate that a person is authorized to operate a motor vehicle – it is not a universal identity card.
The commissioners also cautioned retailers to consider the costs of collecting such sensitive data.
Many provincial driver’s licence numbers are permanent and are only retired when someone is deceased. As such, it is nearly impossible to have the licence number changed. Since the licence number is so static, and because it is a reliable number, it is valuable to identity thieves. Identity thieves use this information to give credibility to their false claims about who they are. A fraudulent driver’s licence number may be more obvious to authorities than one that makes use of valid personal information, so a legitimate number is far more useful to identity thieves. Once a number has been compromised, it can be very difficult to rectify the situation.
Under privacy legislation, organizations have a duty to protect personal information in their custody or under their control by making reasonable security arrangements against risks, such as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. The benefits of collecting and retaining driver’s licence information should therefore be weighed against the security risks posed.
Retailers need to understand that personal data is a highly valuable asset. It must be protected accordingly.
The guide is available here.