Starting July 2, 2026, the Government of Alberta is making changes to driver’s licences and identification (ID) cards for Albertans and to the renewal process for these documents.
Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.
Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.
Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.
What public bodies need to know about this change
Public bodies need to know that the addition of this information to driver’s licences and ID cards may result in overcollection of personal information by these organizations under Alberta’s Protection of Privacy Act (POPA), specifically citizenship information and PHNs.
Permitted collections of personal information under POPA
Public bodies in Alberta are subject to Alberta’s Protection of Privacy Act (POPA). Under POPA there are just three circumstances that permit the collection of personal information by a public body. They are set out in POPA as follows:
4 No personal information may be collected by or on behalf of a public body unless
(a) the collection of that information is expressly authorized by an enactment[1] of Alberta or Canada,
(b) that information is collected for the purposes of law enforcement, or
(c) that information relates directly to and is necessary for an operating program or activity of the public body, including a common or integrated program or service.
More about the term “expressly authorized”
The OIPC has interpreted “expressly authorized” to mean “definitely stated, not merely implied”. POPA section 4(a) can only be relied on by a public body to collect personal information if an Act or regulation of Alberta or Canada states that it, the public body, is authorized to collect the specific information being collected. It is not enough for the Act or regulation to merely imply authorized collection.
In order to rely on section 4(a) in the context of collecting the personal information on a driver’s licence or ID card, the Act or regulation must authorize the specific public body to collect this specific personal information. If an Act or regulation sets out this authority, then only that personal information that is expressly authorized by the Act or regulation may be collected and no more.
There may be Acts or regulations requiring a public body to record the information on a driver’s licence or ID card, including for the purposes of demonstrating citizenship, which may authorize a public body to collect this information. However, it is unlikely that this section could be relied on by a public body to record a PHN.
When relying on section 4(a), public bodies must take steps to ensure not to collect more information appearing on a driver’s licence or ID card than is authorized or required by the Act or regulation to collect.
More about “the purposes of law enforcement”
Section 4(b) of POPA permits a public body to collect personal information if “that information is collected for the purpose of law enforcement”. “Law enforcement” is defined in section 1(1)(k) of POPA as follows.
(k) “law enforcement” means
(i) policing, including criminal intelligence operations,
(ii) a police, security or administrative investigation, including the complaint giving rise to the investigation, that leads or could lead to a penalty or sanction, including a penalty or sanction imposed by the body conducting the investigation or by another body to which the results of the investigation are referred, or
(iii) proceedings that lead or could lead to a penalty or sanction, including a penalty or sanction imposed by the body conducting the proceedings or by another body to which the results of the proceedings are referred.
There may be circumstances where a public body needs to make a record of a driver’s licence or ID card, rather than just viewing the document, for a law enforcement purpose. Where this collection is permitted, public bodies should take care to only collect that information on the driver’s licence or ID card that is required for the law enforcement purpose.
More about “an operating program or activity of a public body”
Section 4(c) permits a public body to collect personal information if “that information relates directly to and is necessary for an operating program or activity of the public body, including a common or integrated program or service”.
There may be circumstances where a public body needs to make a record of a driver’s licence or ID card, rather than just viewing the document, for an operating program or activity of a public body. When relying on section 4(c) to make a record of a driver’s licence or ID card, the public body must ensure that only that personal information on a driver’s licence that “relates directly to and is necessary” for the operating program or activity is collected. Any collection beyond this is unauthorized.
On rare occasions, a public body may have authority under this section to collect a citizenship marker. It is highly unlikely that a public body would have authority under this section to collect a PHN.
Direct collection and notice of collection
Public bodies are required to collect personal information directly from the individual whom the information is about, unless an exception to this requirement exists.
When collecting personal information directly from an individual, public bodies are required to give notice to the individual about the collection. The notice must include: the purpose for the collection; the specific legal authority for the collection; contact information for the public body’s privacy officer so the individual can enquire about the collection; and the public body’s intention, if any, to input the information into an automated system for certain specified activities.
This notice requirement is mandatory unless the “head” of the public body is of the opinion that giving notice could reasonably be expected to result in the collection of inaccurate information. This exception would likely not apply when making a record of a driver’s licence or ID card.
Special considerations for collecting a PHN
Alberta’s Health Information Act (HIA) was recently amended to permit the incidental collection of a PHN when a “person”, which includes a public body, has legitimate authority to require an individual to provide their driver’s licence or ID card for specified purposes, including to verify identity, address, or other details, and incidentally collects a PHN when exercising this authority. This is because, as of July 2, 2026, driver’s licences and ID cards issued to Albertans will include PHNs for most people.
Permitted collection of a PHN under HIA
Section 21(1) of HIA restricts a “person” from requiring an individual to provide their PHN unless this “person” is a custodian or a prescribed “person”. The full list of prescribed persons can be found in Section 5 of the Health Information Regulation.
If a public body does not qualify for the exception to the restriction, then it is not allowed to require the provision of a PHN.
Incidental collections of a PHN
Because there will now be more types of personal information on driver’s licences and ID cards than in the past, circumstances may arise where a “person” requires some of the information, but does not require all of it, for example, the PHN. In these instances, this “person” needs to know that there are two circumstances set out in HIA where it may incidentally collect a PHN.
21.1 Incidental collection of personal health number
(1)…
(2) A person may collect a personal health number displayed on an individual’s operator’s licence or identification card only if, for purposes other than collecting the individual’s personal health number, the person
(a) is authorized under another enactment to require the individual to
(i) provide the individual’s operator’s licence or identification card, or
(ii) establish the individual’s identity, address or other personal information, other than the individual’s personal health number, such that the individual is required to provide the individual’s operator’s licence or identification card; or
(b) requests the individual voluntarily provide the individual’s operator’s licence or identification card.
If these sections do not apply, then a public body may only incidentally collect a PHN under section 21.1(2)(b) when it makes a voluntary request for an individual to provide their driver’s licence or ID card for a specified purpose.
If a voluntary request is made, the individual has the right under section 21(3) to refuse to provide their PHN as part of this request. If the individual exercises this right, then the public body must not retain the individual’s PHN. Alternatively, the individual may simply refuse to provide the driver’s licence or ID card to the public body.
In all cases, a public body that incidentally collects a PHN as permitted by HIA is prohibited from using or disclosing the PHN.
Key takeaways
- Public bodies must not collect personal information on a driver’s licence or ID card unless they are permitted by POPA to do so.
- For certain activities, such as law enforcement or to establish eligibility for certain government programs or services, public bodies may be authorized by POPA to collect citizenship information that appears on a driver’s licence or ID card. However, collection of a PHN may not be permitted and should be avoided.
- If a public body has authority to collect a PHN under POPA, it must ensure it also has authority to do so under HIA and follow the rules under HIA concerning use and disclosure.
- Individuals have the right under HIA to refuse to provide a PHN for any request by a public body to voluntarily provide this information.
- Individuals have the right to make a complaint to the Information and Privacy Commissioner about any collection of this information that the individual believes is not in compliance with POPA or HIA.
- The Information and Privacy Commissioner of Alberta oversees compliance with POPA and HIA and has broad powers to enforce compliance with these Acts.
More Information
If you have any questions about this guidance, please contact generalinfo@oipc.ab.ca.
[1] In Alberta’s Interpretation Act, “enactment” means an Act or a regulation or any portion of an Act or regulation. “Act” means an Act of the Legislature and includes an Ordinance of the North-West Territories in force in Alberta. “Legislature” means the Lieutenant Governor acting by and with the advice and consent of the Legislative Assembly. An enactment of Alberta is, therefore, an Alberta law or regulation. In the federal Interpretation Act, “enactment” means an Act or regulation or any portion of an Act or regulation, and “Act” means an Act of Parliament.
July 2026
Disclaimer |