Starting July 2, 2026, the Government of Alberta is making changes to driver’s licences and identification (ID) cards for Albertans and to the renewal process for these documents.
Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.
Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.
Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.
What private sector organizations need to know about this change
Private sector organizations need to know that the addition of this information to driver’s licences and ID cards may result in overcollection of personal information by these organizations under Alberta’s Personal Information Protection Act (PIPA), specifically citizenship information and PHNs.
Private sector organizations also need to know that there are rules about the incidental collection of a PHN under Alberta’s Health Information Act (HIA) that they must follow to avoid collecting, using or disclosing a PHN contrary to these rules.
Information about how to avoid non-compliance with these Acts as it relates to this personal information is set out below.
Permitted collections of personal information under PIPA
Private sector organizations in Alberta are subject to PIPA.
Under PIPA, they are restricted from collecting any personal information unless they have:
- consent, or authority under PIPA to collect personal information without consent; and
- a reasonable purpose for collecting the personal information.
Even when both these conditions are met, organizations may only collect personal information to the extent necessary for the purpose of the collection. To avoid over-collecting personal information appearing on a driver’s licence or ID card, the organization should implement practices to prevent recording personal information that is not needed.
“Reasonable” is defined in PIPA as “what a reasonable person would consider appropriate in the circumstances”.
Before collecting any personal information on a driver’s licence or ID card, an organization must ensure it has authority to do so under PIPA.
A private sector organization would not generally have authority to make a copy of and keep all the personal information appearing on a driver’s licence or ID card. Organizations should only do so if there is a clear legal obligation to collect and retain this information.
Special considerations for collecting personal health numbers (PHNs)
Alberta’s Health Information Act (HIA) was recently amended to permit the incidental collection of a PHN when a “person”, which includes an organization, has legitimate authority to require an individual to provide their driver’s licence or ID card for specified purposes, including to verify identity, address, or other details, and incidentally collects a PHN when exercising this authority. This is because, as of July 2, 2026, driver’s licences and ID cards issued to Albertans will include PHNs for most people.
Section 21(1) of HIA restricts this “person” from requiring an individual to provide their PHN unless this “person” is a custodian or a prescribed person. The full list of prescribed persons can be found in Section 5 of the Health Information Regulation.
If an organization does not qualify for the exception to the restriction, then it is not allowed to require the provision of a PHN.
Incidental collections of a PHN
Because there will now be more types of personal information on driver’s licences and ID cards than in the past, circumstances may arise where a “person” requires some of the information, but does not require all of it, for example, the PHN. In these instances, this “person” needs to know that there are two circumstances set out in HIA where it may incidentally collect a PHN.
21.1 Incidental collection of personal health number
(1)…
(2) A person may collect a personal health number displayed on an individual’s operator’s licence or identification card only if, for purposes other than collecting the individual’s personal health number, the person
(a) is authorized under another enactment to require the individual to
(i) provide the individual’s operator’s licence or identification card, or
(ii) establish the individual’s identity, address or other personal information, other than the individual’s personal health number, such that the individual is required to provide the individual’s operator’s licence or identification card; or
(b) requests the individual voluntarily provide the individual’s operator’s licence or identification card.
“Person” is defined broadly and includes organizations as defined in PIPA.
“Enactment” is defined in the Interpretation Act. It is an Act or regulation of Alberta. If these sections do not apply, then an organization may only incidentally collect a PHN under section 21.1(2)(b) when it makes a voluntary request for an individual to provide their driver’s licence or ID card for a specified purpose.
If a voluntary request is made, the individual has the right under section 21(3) to refuse to provide their PHN as part of this request. If the individual exercises this right, then the organization must not retain the individual’s PHN. Alternatively, the individual may simply refuse to provide the driver’s licence or ID card to the organization.
In all cases, an organization that incidentally collects a PHN as permitted by HIA is prohibited from using or disclosing the PHN.
Key takeaways
- Organizations must not collect the personal information on a driver’s licence or ID card unless they are permitted by PIPA to do so.
- It is unlikely that an organization would have authority under PIPA to collect citizenship information or PHNs appearing on a driver’s licence or ID card.
- If an organization has authority to collect a PHN under PIPA, it must ensure it also has authority to do so under HIA and then follow the rules under HIA concerning use and disclosure.
- Individuals have the right under HIA to refuse to provide a PHN for any request by an organization to voluntarily provide this information.
- Individuals have the right to make a complaint to the Information and Privacy Commissioner about any practice concerning the collection of personal information that the individual believes is not in compliance with PIPA or HIA.
- The Information and Privacy Commissioner of Alberta oversees compliance with PIPA and HIA and has broad powers to enforce compliance with these Acts.
More Information
If you have any questions about this guidance, please contact generalinfo@oipc.ab.ca.
The OIPC has resources for organizations concerning the collection, use and disclosure of driver’s licences and ID cards by private sector organizations:
Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation
Guidelines for Licensed Premises: Collecting, Using and Disclosing Personal Information of Patrons
Landlords and Tenants: Guidance on PIPA
Guidance on Motor Vehicle Dealership Test Drives
The following Order and Investigation Report address this topic:
Below are some additional orders and investigation reports issued by the OIPC relevant to collecting driver’s licence information in various ways by organizations subject to PIPA.
P2008-IR-002 (DeVry Institute of Technology’s requirement to photocopy identity cards, including driver’s licences, in connection with potential future loans for tuition applications processed by a third party)
P2007-016 (Home Depot’s practice of collecting and retaining driver’s licences as part of its refund policy)
P2006-011 (Tantra Nightclub scanning driver’s licences on entry)
P2005-IR007 (certain Canadian Tire stores photocopying driver’s licences as part of their return policy)
July 2026
Disclaimer |