Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation: A friendly reminder to retailers
Albertans have a growing interest and expressed concern about the practice retailers have developed around the collection of their Personal Identifiable Information, specifically their Driver’s Licence digits.
Retailers have an obligation to consider gathering Driver’s Licence Numbers and are encouraged to carefully consider if they actually need this information or not. They are also required to clearly tell customers why they are collecting the information and then ask for the least amount to meet their purposes.
The Office’s of the Information and Privacy Commissioners of Alberta, British Columbia, and Canada collaborated in 2007 and produced a document to help guide retailers into better practice with information gathering procedures. However, today in February 2020, at my local Agricultural machine dealer, the sales representative requested my drivers licence, placed it nicely on his desk next to my business card and proceeded to snap a photo on his personal smartphone without clearly telling me why they were collecting the information. Last year I had a similar experience while purchasing a sea can, however, in that situation they took my licence and placed it on the cold glass of the photocopier and hit the big green button without a word as to why.
In each scenario, I objected. I left the sea can dealership with my photocopy and politely requested the skid steer sales rep to delete the photo in front of me from his personal device. These interactions are generally not seen as teachable moments in which the retailers apologize and learn from, but rather defensiveness from the sales person stating their reasons why, which simply aren’t enough. The onus is on the retailer to properly train staff so moments of buyer education doesn’t forfeit the sale.
What the Driver’s Licence is
The Drivers Licence is a card to identify a driver, for a means to enforce traffic laws and offer proof that someone is authorized to operate a motor vehicle. This is a sensitive number and for that reason, is often the subject of misuse.
What the Driver’s Licence isn’t
The Driver’s Licence is not a universal identity card.
Retailers Business with Privacy
In Canada, there are four laws that govern the personal information practices of retailers. It is important for retailers to understand that the location of your business determines which privacy law they must adhere to. In Alberta, the legislation is Personal Information Protection Act (PIPA), which is overseen by the Alberta Office of the Information and Privacy Commissioner.
Government issued ID is attractive to retailers because it is considered reliable and up to date. A retailer and see your photo, current home address, date of birth, hand signature, physical description such as height and weight.
Deciding how and why to collect the DL
A retailer can collect the drivers licence number in a variety of ways according to the law. They can examine the licence, record information from it, such as the number, or photocopy it. This day and age, they can also choose to take photos of it with their personal device, as I have seen it with my own eyes. They provide reasons for needing to do so as to properly identify a person, to deter and detect fraud/crime, protect and recover assets, to prove staff in fact examined buyers ID, and to ensure that someone is licenced to drive. An deeper look into these reasons explained can be found here https://www.oipc.ab.ca/media/383670/guide_collection_of_licence_numbers_mar2007.pdf
When is it okay?
The Federal Proceeds of Crime and Terrorist Financing Act and Regulations explicitly require financial institutions to record such identification numbers, which is considered reasonable. That’s it.
Taking a photo of your photo? Smartphone or Photocopy
Recording information by photo or photocopy isn’t generally accepted due to the additional unnecessary information which is also provided inadvertently. So, did Skid Steer sales representative need to know how much I weighed in order for me to purchase the machine, no. Did he need to know my weight? No. Did he need a photo of my photo? No. Did he need my signature on record? No. Therefore, it is reasonable to believe that gathering the unintended information on the Driver’s Licence is excessive. The rule of thumb is simply to collect the least amount of information as possible AND….If you can’t protect the information you gather, do not collect it at all.
Where to get more information
http://www.privcom.gc.ca/information/guide_e.asp
http://www.privcom.gc.ca/privacy_comm/0001_home_e.asp
http://www.privcom.gc.ca/information/guide/auth_061013_e.asp
http://www.privcom.gc.ca/fs-fi/02_05_d_34_tips_e.asp
http://www.oipc.ab.ca/ims/client/upload/Privacy%20Proofing_Mar19.pdf
http://www.oipc.ab.ca/ims/client/upload/PIPAguide_Nov2008_web.pdf