Your Customers’ Driver’s Licence Card
Do you need it?
A Guide for Retailers
Retailers commonly ask customers for their driver’slicence cards, especially when the customer wants to return products without a sales receipt. Some stores just look at the card and give it back; others write down the licence number, name or other information, and still others photocopy, scan or swipe the card for their records.
Retailers cite a variety of reasons for asking for the driver’s licence information of their customers. Increasingly, however, customers are growing concerned about the collection and use of the personal information available on driver’s licences and other government-issued identification cards.
The offices of the Privacy Commissioners of Canada, Alberta and British Columbia investigated several consumer complaints and have issued findings that, taken as a whole, offer retailers guidance on the proper management of driver’s licence information.
This brochure provides only an overview of the issues. For more information, including case summaries and other reference sources, please see Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation: A Guide for Retailers on our websites, listed at the end of this pamphlet.
About the Driver’s Licence
Rule No. 1:
A driver’s licence is not a universal identity card. It is a way for drivers to show they are authorized to operate a motor vehicle and for authorities to enforce traffic laws.
Driver’s licence numbers are unique to the driver and usually last a lifetime. The cards also contain a lot of personal information, including the name and address of the licensee, a picture and some physical descriptions, a signature, and – depending on the province – the driver’s year of birth and gender.
All this information is useful to retailers because it can:
- Confirm the customer’s identity
- Reveal where the customer lives
- Provide a unique identifying number that retailers can use for their own record-keeping.
Privacy Commissioners, however, have warned that a driver’s licence is not a universal identity card. It is a way for drivers to show they are authorized to operate a motor vehicle and for authorities to enforce traffic laws.
This guide summarizes the rules that exist to protect the personal information of licensees.
Private Sector Privacy Laws
Appealing to Thieves
Driver’s licences have credibility because they are issued by governments. This makes them very valuable to identity thieves, who can conceal their fraudulent activities behind authentic personal information.
Licence numbers in many provinces are almost impossible to change and are only retired when the owner dies. This permanence also enhances their attraction for identity thieves, while making it harder for a licensee to replace a compromised licence number.
Retail outlets and other private enterprises in most of Canada are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). In B.C. and Alberta they are subject to similar statutes, referred to in both cases as the Personal Information Protection Act, or PIPA. In Quebec, An Act Respecting the Protection of Personal Information in the Private Sector is in force.
These laws require retailers to tell customers clearly why they are collecting their personal information, and to request only the information that would reasonably allow them to meet their business needs. This is the case even if a customer is prepared to offer more personal information.
Retailers are also required to protect personal information in their care against risks such as unauthorized use or disclosure.
The Banking Exception
Rule No. 2:
Collect only what you absolutely need, even if the customer is prepared to offer more personal information.
Retailers may feel justified in collecting personal information such as driver’s licence numbers because the practice is common among banks and other financial institutions.
However, financial institutions are subject to the federal Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which explicitly requires them to record identification numbers in certain circumstances.
This obligation has been found to be reasonable and in compliance with privacy laws, but applies to only very few organizations.
Overview of Findings
Rule No. 3:
You can satisfy most of your information needs simply by examining a driver’s licence. Recording the licensee’s name and perhaps the address from the card may also be appropriate.
However, it is generally considered excessive and unjustified to record the number from the licence, or to swipe, photocopy or otherwise reproduce the card.
Federal and provincial Privacy Commissioners have considered several reasons put forward by retailers for collecting driver’s licence information, and have concluded that most needs can be met merely by examining the identification. For example, you can simply match the name and photo on the card to the credit card of the person standing in your store.
Recording the person’s name and perhaps the address from the card is sometimes also appropriate when, for example, a customer is returning goods.
For the most part, however, Privacy Commissioners have concluded that writing down the driver’s licence number from the card, or photocopying, “swiping” or otherwise reproducing the card itself, cannot be justified. The number may encode personal information such as the licensee’s birth date, and the card contains a photograph, signature and other personal information that exceeds what is needed for most business purposes.
As a retailer, it is important to collect only the personal information you reasonably require. Under the law, it’s up to you to safeguard its security.
Examining the Arguments
Identifying a customer – Retailers often say they want to positively identify a customer, such as a person who arrives to pick up merchandise that was previously paid for or is being invoiced to an employer.
Recording the person’s licence number may seem like a good way to show you have exercised due diligence in verifying the individual’s identity. However, you can achieve this goal in less privacy-invasive ways.
For example, consider having your employee first examine the driver’s licence, then initial the related sales documents to confirm that this step was taken.
Deterring fraud – Many retailers like to see a driver’s licence when a customer pays by credit card, since credit cards usually carry only the name of the cardholder.
Requiring customers to identify themselves can deter those with fraudulent intentions.
However, it is usually sufficient to examine the licence and photograph to verify that the person presenting the credit card is the cardholder. Depending on the situation, you may be justified in collecting further information, including the name or address on the card.
Some retailers also argue they need to collect licence numbers in case there’s a crime. However, where the real risk is low, the information collected from many other innocent people will rarely, if ever, be used.
Even where the risk of illicit activity is high, you must be able to show that the collection and use of personal information actually deters crime. Given the need to safeguard any personal information collected, other security measures may turn out to be more effective.
Detecting fraud – Retailers who accept merchandise returns without a receipt argue they are vulnerable to customer fraud because the merchandise may have been stolen or may not even originate from the retailer. They say they collect licence numbers as a form of protection.
Privacy Commissioners have acknowledged the risk involved in refunds or exchanges and accept that the collection of limited personal information may be appropriate. However, they say that the driver’s licence number should not be used as a tracking number for retailers who use it to detect whether certain customers are demonstrating an excessive pattern of returns without receipts.
The driver’s licence number was not intended as a numeric identifier for statistical analyses. One alternative is to create your own numeric identifier system that you could cross-reference by address for individuals with the same name.
Co-operating with police – Many retailers have said that they can help combat fraud, theft or other crimes by giving police the name and driver’s licence of a suspected offender.
However, if you have a customer’s name and address, this is usually enough information for police to track down the suspect. The licence number itself is not necessary because police can conduct a search using only a name and perhaps an address.
You may be tempted to collect driver’s licence numbers as a way to protect your business. In most cases simply examining the card will provide the protection you seek.
Don’t forget that privacy legislation requires you to protect the personal information you collect. In the end, you need to weigh the potential benefits of gathering this information against the security burden it poses.
For more information, please contact:
Office of the Privacy Commissioner of Canada
112 Kent Street, Tower B, 3rd Floor
Ottawa, ON K1A 1H3
Phone: (613) 947-1698
Fax: (613) 947-6850
TTY: (613) 992-9190
Office of the Information and Privacy Commissioner of Alberta
#2460 – 801 6 Avenue SW
Calgary, Alberta T2P 3W2
(403) 297-2728 or 1-888-878-4044
Fax: (403) 297-2711
Office of the Information and Privacy Commissioner for British Columbia
PO Box 9038, Stn. Prov. Govt.
Victoria, BC V8W 9A4
Toll Free Vancouver: (604) 660-2421
Elsewhere in BC: 1-800 663-7867
Fax: (250) 387-1696
Cat. No. IP54-25/2009