Manitobans gave more private info than necessary in online sale of park pass, licences: ombudsman

Manitobans are required to disclose too much personal information to buy a provincial park pass or hunting and fishing licence online, the province's ombudsman ruled.

The report argues it "is not reasonably necessary" that customers reveal their driver's licence number, passport number or personal health identification number to use the third-party online system, which Manitoba started using in 2020.

Divulging personal information for this purpose contravenes the Freedom of Information and Protection of Privacy Act and Personal Health Information Act, the ombudsman said.

Ann Cavoukian, Ontario's former privacy commissioner, said the level of information Manitobans are disclosing to visit a provincial park or cast a fishing line is "absurd." 

"Personal health information is being collected, which it shouldn't, and sensitive information like passport numbers and drivers licences just to get a hunting licence or whatever?" she said. "Far too excessive."

The ombudsman called on the province to immediately stop collecting people's personal health identification number and destroy all records, which the province says it did last year.

The report also recommends the province limit the collection of other forms of personal information, such as a driver's licence or passport number. This information is considered an "identifier" that's required when setting up a customer account.

The government said it is currently working to address that recommendation — but not fast enough, Cavoukian argued.

"That's the most damaging one," she said. "The enormous concern is when personal identifiers are used and collected in methods like this."

Cavoukian, who founded the "privacy by design" concept that calls on embedding privacy protections from the beginning to prevent future harms, said identity theft is becoming a growing threat that cannot be dismissed.

"It's really hard to completely restrict the use [of this information] to this and no one else gains access to it," she said. "They haven't even said if they're going to try and de-identify the data."

Ombudsman investigated complaints

The ombudsman started its investigation in 2020 after receiving complaints from the public about the amount of information the Texas-based e-licensing vendor, RA Outdoors Ltd., operating as Aspira, wanted.

Individuals have been required to disclose personal information and personal health information to set up a customer account, the ombudsman said. Customers could sign into their account at any time to buy licences and permits. 

The ombudsman ruled that department sought too much information. FIPPA establishes that personal information may only be collected for a specific authorized purpose, and that collection must be limited to only as much personal information is reasonably necessary for the designated purpose.

The report explained some products like a provincial park vehicle permit only required a vehicle licence plate under the previous paper-only booking system, but now the online vendor demands more information just to create a customer account.

The ombudsman suggests the e-licensing system could instead offer individuals the option of being a "guest" rather than creating an entire customer account.

"If this option were offered, the e-licensing system would only need to collect personal information specific to the licence or permit being purchased, and the transaction being made," the document states.

The ombudsman's report was dated Mar. 31, 2023, but was only published on the ombudsman's website last week. 

Online service more expensive

The privacy concerns are the latest blow the Progressive Conservative government is facing over its e-licensing agreement with Aspira. In 2020, the province moved from an exclusively paper-only system into a more expensive online process. Aspira tacked on a $4.50 administration fee with each transaction, which nearly doubles the price of a day pass that once cost $5.

The province is also paying the company more than $1 million in e-licensing fees, according to documents obtained by the NDP.  

NDP Leader Wab Kinew said it's inexcusable that Manitobans' personal information was put at greater risk. It adds credence to his party's argument the government should look to an online vendor within the province instead, he said.

"Why do Manitobans have to enter into a business relationship with an American company to go outdoors and enjoy Manitoba?

"I think this privacy issue is just a red flag for what has been a bad deal for Manitobans."

A spokesperson says the Manitoba government owns and controls all data collected through the online platform. The data is stored in Canada and is not shared or sold to any third party. 

Greg Nesbitt, the minister of natural resources and northern development, said the government is taking the privacy of Manitobans seriously by responding to the various recommendations.

Province will honour contract: Nesbitt

"I think that we should only be collecting the information we need to get people's licences. I respect the work of the ombudsman on this."

He said Manitoba entered into the e-licensing contract with Aspira through an open tendering process. Though it's a U.S. company, Aspira has lots of connections with Canada, including providing e-licensing services in Alberta and Saskatchewan and employing support staff in various provinces, such as Manitoba. 

"That being said, we intend to honour the contract and when the new [request for proposals] comes out, we'll certainly look at anyone who wants to bid on this contract," Nesbitt said.

Manitoba's contract with Aspira expires in March 2025. Aspira did not respond to a request for comment.