Retailer's Guide to Privacy of Information
Collection of Driver's Licence Numbers Under Private Sector Privacy Legislation
Many Canadians have been asked by retailers for their driver’s licences when making a purchase with a credit card and in some cases they may have even noticed that the sales associate wrote their driver’s licence number down on the store’s copy of the receipt. It was this exact practice that prompted many Canadians to raise this issue with the Privacy Commissioner of Canada as well as those in BC and Alberta specifically.
In response, the Privacy Commissioner released a guide for retailers in regards to what information they can and cannot reasonably collect from customers. The guide is clearly written and addresses the 4 most common reasons for collecting driver’s licence numbers cited by retailers: identity verification, deterring fraud, detecting fraud, and to recover assets / report to police / find someone.
Reason: Identity Verification
Many retailers cited identity verification as their reason for recording driver's licence numbers. They want to make sure they know who they are doing business with for a number of reasons. Recording a driver's licence number in this instance is too much. It should suffice to have retail employees simply check the persons driver's licence and then indicate that such a check has occured on a form or log sheet.
Reason: Deterring Fraud
Deterrence is often given as a reason for collecting licence numbers. Indeed, requiring individuals to identify themselves can deter those with malicious intentions. Deterrence, however, is often achieved by the examination of a driver’s licence; it does not require recording of the licence number.
Reason: Detecting Fraud
Many retailers have collected licence numbers for the purpose of detecting fraud. Retailers who accept merchandise returns without a receipt have explained that they are vulnerable to customer fraud. The Commissioners have accepted that retailers can be at risk when providing cash back for merchandise being returned without a receipt. The merchandise may have been stolen or may not even originate from the retailer. The Commissioners have therefore accepted that the collection of limited personal information during an exchange or refund was appropriate. However, the Commissioners have consistently found that it is not reasonable to record driver’s licence numbers during merchandise returns.
Reason: To Recover Assets, Report to Police, or Find Someone Later
Many retailers suggest that they can report a person and their driver’s licence number to police in the event of a crime (such as fraud), or the driver’s licence number can be used to trace a person if property is not returned or there is an outstanding debt. Organizations often think that it will be helpful to police, and easier to find someone, if the driver’s licence number can be searched in motor vehicle registries. However, if an organization is already verifying a person’s name and address (and perhaps recording this information as it appears on the licence), this information in itself will be enough to give to police in almost all cases. Police are able to search
motor vehicle registries using a verified name (perhaps cross-referenced with an address), and do not require the driver’s licence number.
What About Photocopying the Licence?
Even if it is okay to record certain information, photocopying or scanning the licence generally goes too far. Why? As the driver’s licence contains such other information as a photograph, height and other physical descriptions, and signature, this is more information than is needed for most business purposes. With the possible issuance of enhanced driver’s licences in some provinces, the privacy concerns are even greater.
Rule of Thumb
Retailers should collect the least amount of personal information possible to satisfy a legitimate business activity. This duty is distinct and irrespective of any consent obtained from an individual. Even in cases where individuals willingly agree to proviude their driver's licence information, the organization must still satisfy the reasonableness requirement set out in PIPEDA* and PIPA** legislations.
*PIPEDA: Personal Information Protection and Electronic Documents Act (Federal)
**PIPA: Personal Information Protection Act (BC and Alberta)