The Canadian, Alberta and British Columbia Privacy Commissioners have today jointly released a guidance document on the collection of drivers' license information by retailers.

It's here: Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation - Privacy Commissioner of Canada.

And here's the media release:

Retailers must limit collection of driver's licence information, Commissioners say

Ottawa, December 2, 2008 - Retailers have to exercise caution when it comes to collecting information from consumers' driver's licences and recording the numbers, according to three of Canada's privacy guardians. And Canadians are concerned about this growing trend.

To address consumers' unease and retailers' confusion, the Privacy Commissioner of Canada and the Information and Privacy Commissioners of Alberta and British Columbia today released new guidance on this issue.

"More and more retailers are asking to see driver's licences and are recording numbers, often in contravention of privacy laws," says the federal Privacy Commissioner, Jennifer Stoddart.

The new guidelines will help retailers determine whether it is appropriate to collect driver's licence numbers.

Retailers say they are asking for driver's licence information for a number of reasons. For example, they use it to verify the identity of someone using a credit card or picking up merchandise that has already been paid for. Many also use driver's licence numbers to deter and detect fraud, particularly when merchandise is being returned without a receipt.

"A driver's licence is proof that someone is allowed to drive a car. It is not a universal identity card. Nor is it an appropriate identifier for use in analyzing shopping return habits," says B.C. Information and Privacy Commissioner David Loukidelis.

The Commissioners noted that a driver's licence number is a particularly sensitive piece of information which can be valuable to identity thieves.

All three Commissioners have received many complaints about retailers requesting driver's licence information.

"Many Canadians are uncomfortable with retailers recording their driver's licence numbers. In most cases, we agree that this going too far," says Frank Work, Alberta's Information and Privacy Commissioner.

Polling by the Office of the Privacy Commissioner of Canada has found that more than half of Canadians say they are concerned about giving their personal information to retailers.Alberta, British Columbia and Quebec have adopted privacy laws covering the private sector. Everywhere else in Canada, federal privacy legislation applies.

The common criteria in all this legislation requires that the collection of the personal information from the driver's licence must be for a specific and reasonable purpose.

Retailers need to limit the collection of personal information to the least amount needed to achieve a specific purpose – such as confirming a customer's identity. They must be able to explain to customers why they are collecting this information. They are also required to protect it with appropriate security measures.

The new guidelines explain that many business purposes can be satisfied by simply looking at identification, or, at most, recording the name and address appearing on the licence.

There is a major difference between examining a driver's licence and recording the number on it – or even photocopying the whole document. Recording this kind of sensitive information raises the risk of a privacy breach down the road, while a photocopy involves the collection of information well beyond a name and address, including a photo, signature and physical descriptions.

"Retailers want to foster good relationships with their customers, and they understand that respecting their privacy is a key issue. These guidelines help clarify the rules for both consumers and retailers, and we encourage all our members to ensure that they put the appropriate practices in place," says Derek Nighbor of the Retail Council of Canada.

Consumers should ask for an explanation of why their driver's licence information is being requested – particularly when a retailer attempts to record the number or photocopy the licence. If consumers are not satisfied with the explanation, they can ask to speak to a manager or the person responsible for privacy issues.

Consumers can also contact the appropriate Privacy Commissioner's Office if they still have doubts about whether the collection of their personal information is appropriate.

The guidelines are available on the Commissioners' websites: http://www.privcom.gc.ca/; http://www.oipc.ab.ca/; and http://www.oipcbc.org/.

Collection of Driver's Licence Numbers Under Private Sector Privacy Legislation – A Guide for Retailers (PDF Version)

Labels: privacy