Check but don't photocopy driver's licences, privacy watchdogs tell retailers

Retailers should check but not swipe or photocopy customers' drivers licences, privacy commissioners in Canada warned, noting the cards contain personal information prized by identity thieves.

The Office of the Privacy Commissioner of Canada, along with counterparts in Alberta, B.C., and Quebec, on Tuesday issued a series of guidelines to retailers on the collection of driver's licence numbers.

"By and large, the federal and provincial privacy commissioners have agreed with those Canadians who think that recording driver's licence numbers is excessive," the guide states.

The privacy commissioners acknowledged many retailers use licences as a means of verifying identity and detecting fraud. But they note retailers should limit their collection of data to a name and an address.

The Alberta privacy commissioner fielded several complaints against retailers who recorded licence numbers while completing credit cards transactions.

The retailers argued the process was intended to stave off credit card fraud, though the privacy commissioner responded that a careful examination of the driver's licence would have proved sufficient.

The commissioners also noted some retailers record licence numbers to monitor customers making overly frequent returns without a receipt. The privacy commissioners recommended instead creating an internal numeric system to cross-reference addresses, names and return.

"These retailers simply require a number — any number — that may consistently be associated with the same person," the commissioners said. "Many retailers believe the driver's licence number is the most convenient, unique number to use, but this convenience does not supersede an individual's right to information privacy."

The collection of driver's licence numbers also places an added responsibility on retailers to protect the data, the commissioners cautioned. In some provinces, licence numbers are not reissued or altered. Identity thieves accordingly prize these types of identification.

"Once a number has been compromised, it can be very difficult to rectify the situation," the report said.

The commissioners noted in their report that financial institutions are legally obligated to record identification numbers.