For decades, retailers have requested customers’ driver’s licenses during standard retail transactions such as credit card transactions and merchandise returns. They often record the unique identification numbers or even copy the entire document. Generally, retailers will cite a number of seemingly legitimate reasons for requiring this type of photo identification: verification of a customer’s identity, detection and deterrence of fraud, recovery of assets, the reporting of individuals to the police or the tracing of individuals at a later date.
In recent years, the Privacy Commissioners in Canada, British Columbia and Alberta (Commissioners) have seen an increase in consumer complaints about retailers’ driver’s license collection practices. The Commissioners have released a series of decisions on this matter and, in December 2008, released a guide entitled, “Collection of Driver’s Licence Numbers under Private Sector Privacy Legislation – A Guide for Retailers” (Guide). These decisions and the Guide make it clear that, in most circumstances, retailers may not record driver’s licences.
The Commissioners’ position is based on a basic principle of privacy law which requires that organizations may only collect, use or disclose personal information for appropriate or reasonable purposes. Moreover, such collection must be limited to what is necessary or reasonable to meet those purposes. In the context of driver’s licences, “collection” includes examining the driver’s licence, recording information from it (such as the driver’s licence number) or photocopying it.
Although the Commissioners agree that most of the purposes cited by retailers for the collection of driver’s licence information are reasonable and legitimate, the extent of collection invariably goes beyond what is necessary to achieve these purposes. The Commissioners argue that most of these purposes can be addressed by simply examining identification and/or recording the person’s name and/or address as it appears on the licence.
For example, although the deterrence and detection of credit card fraud are valid purposes, identification can be satisfied by examining a customer’s driver’s licence and photograph to verify his/her identity. Recording or copying the credit card is not reasonably necessary to fulfill this legitimate purpose. Note that this requirement applies regardless of whether the consumer has otherwise consented to the collection.
Accordingly, the Guide recommends that before collecting driver’s licence information, retailers consider the necessity and legitimacy of the collection, and the least amount of personal information that must reasonably be collected to fulfill such purpose. The Guide suggests that in most cases, retailers will be limited to the examination of driver’s licences and, perhaps, the recording of certain information such as the name and address on the licence. The circumstances in which a retailer may legitimately copy a driver’s licence or record the licence number are rare.