Privacy commissioner issues guidance as changes to Alberta ID program take effect

Alberta’s information and privacy commissioner issued guidance to the public on Thursday as changes to the province’s ID card program take effect.

The province is adding health numbers and Canadian citizenship markers to all new and renewed cards going forward, a move the government says is meant to eliminate the need to carry multiple pieces of ID to access government programs and services. The new cards will also sport new security features protecting against fraud.

Commissioner Diane McLeod, who works independently of the government to carry out duties in Alberta’s access to information and privacy laws, says there are risks to a greater number of people and bodies having access to citizenship and health information through handling Albertans’ ID cards.

As such, her office has issued guidance for the public, as well as organizations and public bodies.

“I encourage Albertans to review this guidance to gain a better understanding of how to protect the new information added to their driver’s licences or ID cards when interacting with public and private sector entities,” McLeod said in a statement Thursday.

“I also encourage public bodies and private sector organizations to review the guidance relevant to them, in order to minimize the risk of over-collecting the personal information appearing on these documents, particularly citizenship information and personal health numbers.”

Guidance for individuals

The commissioner is reminding the public that private-sector organizations like retailers and bars generally do not have authority to make a copy of a licence or ID card without a legal requirement, and are limited as to the information they can collect. If a private-sector organization asks to make a copy of a licence or ID, Albertans should ask them for their authority under the Personal Information Protection Act (PIPA), and, if Albertans are concerned about this, the name of their privacy officer to discuss the issue further.

Health professionals and institutions like hospitals are permitted to collect personal health numbers, although it is unlikely that they would be permitted under the Health Information Act (HIA) to record the other information now on Alberta ID cards, like citizenship. If asked in this setting for a copy of their ID card, Albertans are advised to ask what the custodian’s authority is to collect all of the information on their card.

Public bodies like government departments and law enforcement can make a copy of a licence or ID card as part of the process of delivering a program or service, or when legislated. However, often, ID cards will only need to be displayed to verify identity. The commissioner says it is unlikely that a public body would have authority to collect a personal health number. If a public body does request a copy of an ID card, Albertans are advised to ask for their authority under the Protection of Privacy Act (POPA) to collect all of the information on the card. Albertans can also ask for their privacy officer to discuss any concerns further.

Complaints in any of these situations can be made to the office of the information and privacy officer.

Additionally, Albertans can consider obscuring unnecessary information on their ID or asking an agency to do this before making a copy.

“Take extra precautions when providing your driver’s licence or ID card when you are travelling outside of Alberta because Alberta’s privacy laws do not apply in this circumstance. However, other privacy laws may apply,” reads the commissioner’s guide.

Read the commissioner’s full guidance for the public here.

Guidance for private-sector organizations

The commissioner is warning the private sector that it needs to be wary of the “overcollection of personal information” under PIPA, and rules around incidental collection of personal health numbers under HIA.

To avoid non-compliance, the commissioner is urging private-sector organizations to ensure the conditions for collecting personal information are met and implement practices to prevent recording unnecessary information.

The commissioner is also reminding them that individuals have the right under HIA to refuse to provide a personal health number and make a complaint to the information and privacy commissioner.

Read the commissioner’s full guidance for the private sector here.

Guidance for public bodies

Public bodies, also, need to be aware of overcollecting personal data and the circumstances set out in POPA that allow for data collection.

They are also required in most cases to notify an individual that they are collecting their personal information.

Still, while some activities like law enforcement will require collection of citizenship information, public bodies should avoid collecting personal health numbers without authority under POPA.

The commissioner also reminded public bodies that individuals have the right under HIA to refuse to provide their health number voluntarily, and to make a complaint about information collection to the information and privacy commissioner.

Read the commissioner’s full guidance for public bodies here.

Documents needed at registry

As of Thursday, those applying for a new or renewed card will need to bring ID and proof of their legal residency in Canada, such as a birth certificate, as well as their Alberta Health Care card.

Citizens will receive a “CAN” marker on the top right corner of their card.

Non-citizens can still obtain a licence or ID card, and a one-time 60-day grace period can be enacted for those needing extra time to gather the required documents.