Photo identification guidance

September 2007

---

Some organizations require customers to show photo identification to verify that a customer who wishes to use a credit card to purchase goods or services is in fact the individual named on the credit card offered. They do this for fraud prevention purposes.

Credit card fraud is broadly known to be a significant problem and it is widely accepted that organizations need to take reasonable measures to reduce its occurrence. Verifying identity to prevent credit card fraud in the retail sector is a practice that has been endorsed not only by credit card companies and payment card processors, but also privacy commissioners. This is because, to a large extent, confirmation of identity effectively addresses problems with unauthorized use of credit cards at point of sale.

The purposes of the Personal Information Protection Act in Alberta and in British Columbia are stated in those laws as follows:

The purpose of this Act is to govern the collection, use and disclosure of personal information by organizations in a manner that recognizes both the right of an individual to have his or her personal information protected and the need of organizations to collect, use or disclose personal information for purposes that are reasonable.

The purpose of the federal Personal Information Protection and Electronic Documents Act (PIPEDA) is stated as follows:

The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

The Office of the Information and Privacy Commissioner of Alberta and the Office of the Information and Privacy Commissioner for British Columbia, as well as the Office of the Privacy Commissioner of Canada, accept that organizations may require customers who wish to pay for goods or services by credit card to show proof of identity by showing a driver’s licence or other photo identification.

The collection of personal information must be limited to examination of identification only and must not involve recording of personal information from the identification offered, including driver’s licence numbers or addresses. Organizations must only compare the name and photo on the identification with the name on the credit card.

The above practice strikes a balance between the privacy rights of individuals and the need of organizations to collect personal information for purposes that are reasonable. For more information on this issue, please consult the following documents: