Equipment store ends practice of photocopying driver’s licences as a condition of renting equipment
Early resolved case summary #9
Lessons Learned
- Organizations should collect only the amount of personal information required to satisfy a legitimate business activity.
- It is generally considered inappropriate to record a driver’s licence number, or to swipe, photocopy or otherwise reproduce a driver’s licence, for the purpose of addressing customer theft.
Complaint summary
The complainant alleged that an equipment store did not permit him to pick up rental equipment without making a scanned copy of his driver’s license and taking his photograph. The respondent confirmed the complainant's allegation about their rental policy and indicated it was unwilling to discontinue this practice, as it had suffered significant losses of expensive rental equipment in the past.
Outcome
The respondent was made aware that the OPC had encountered similar complaints in the past and relevant guidance was provided to the respondent (Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation). Our Office explained that driver’s licences should generally not be recorded as they contained excessive information about the customer, such as photograph, signature and physical descriptions. Further, in the event that equipment is lost or stolen, a copy of a driver’s licence and its corresponding number is of minimal value to police in an investigation. For this reason, the collection of driver’s licence information did not appear to be appropriate under the circumstances.
As a result of our involvement, the respondent implemented a new solution that was less privacy-invasive than copying customers’ driver's licences, and provided training for staff. The complainant was satisfied with the actions taken by the respondent.
October 2014
- Date modified: