Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.

Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.

Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.

What does this mean for the privacy of this sensitive personal information?

Driver’s licences and ID cards are used for a variety of purposes. Having more information on these cards means that this additional personal information may be collected by those persons or bodies to whom you provide your driver’s licence or ID card, as may be required by law or where requested voluntarily for identification or other legitimate purposes.

The Information and Privacy Commissioner of Alberta is responsible to monitor compliance with Health Information Act (HIA), the Personal Information Protection Act (PIPA), and the Protection of Privacy Act (POPA).

HIA applies to custodians, including your doctor and other health professionals, as well as larger health institutions, such as hospitals. PIPA applies to private sector organizations, such as law firms, retailers, liquor stores, and bars. POPA applies to public bodies, including government departments and law enforcement agencies.

Collection by custodians – HIA

Custodians are permitted to collect your personal health number to provide you with health services.

It is unlikely that a custodian would be permitted under the HIA to record the other information appearing on your driver’s licence or ID card, including your citizenship marker. This is because HIA restricts the type of health information that custodians can collect.

If a custodian makes a copy of your driver’s licence or ID card, you should ask what their authority is to collect all the information on the driver’s licence or ID card.

If you have concerns about unauthorized collection of the information on your driver’s licence or ID card, you should address your concern with the custodian.

If you are not satisfied with the custodian’s response, you may make a complaint to the OIPC.

Collection by private sector organizations – PIPA

Private sector organizations would not generally have authority under PIPA to make a copy of your driver’s licence or ID card, unless there is a legal requirement by this organization to collect this information in this manner. Instead, in most cases, individuals may display the driver’s licence or ID card to verify identity or age, without the need for a copy to be made.

PIPA limits what personal information an organization may collect. It is unlikely that an organization under PIPA would have authority to collect your personal health number or citizenship marker.

If an organization under PIPA asks to make a copy of your driver’s licence or your ID card, or makes a copy of these documents, ask them for their authority under PIPA to do this. If you have concerns about this, ask for the name of their privacy officer to discuss this authority. You may make a complaint to the privacy officer if you suspect non-compliance with PIPA for this practice.

If you are not satisfied with the organization’s response, you may make a complaint to the OIPC.

Collection by public bodies – POPA

Public bodies would only be permitted to make a copy of your driver’s licence or ID card if they are permitted to do so as part of delivering a program or service, or if authorized by law. Instead, in most cases, individuals may display the driver’s licence or ID card to verify identity or age, without the need for a copy to be made.

There are some programs and services of government that require you to prove your citizenship. A public body may be able to collect this information from your driver’s licence or ID card without taking a copy. It will depend on the program or service requirements. It is unlikely that a public body would have authority to collect your personal health number.

If a public body asks to make a copy of your driver’s licence or your ID card, or makes a copy of these documents, ask them for their authority under POPA to collect all the information on your driver’s licence or ID card. If you have concerns about this, ask for the name of their privacy officer to discuss this authority. You may make a complaint to the privacy officer if you suspect non-compliance with POPA for this practice.

If you are not satisfied with the public body’s response, you may make a complaint to the OIPC.

Additional steps you can take to protect your personal information on your driver’s licence or ID Card

Consider obscuring unnecessary information on your driver’s licence or ID card before a copy is made or the document is viewed. When doing this, take care not to damage the card.

Before a person makes a copy, ask the person to obscure unnecessary information so that only the information that is required from the card is copied.

You may also consider covering up certain personal information, such as your citizenship marker or your personal health number, prior to showing your driver’s licence or ID card to any person.

Things to remember

Take extra precautions when providing your driver’s licence or ID card when you are travelling outside of Alberta because Alberta’s privacy laws do not apply in this circumstance. However, other privacy laws may apply.

Alberta’s privacy laws do apply when you provide your driver’s licence or ID card while you are in Alberta to an organization operating outside of Alberta, such as may be the case for online activities.

July 2026

Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.

Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.

Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.

What private sector organizations need to know about this change

Private sector organizations need to know that the addition of this information to driver’s licences and ID cards may result in overcollection of personal information by these organizations under Alberta’s Personal Information Protection Act (PIPA), specifically citizenship information and PHNs.

Private sector organizations also need to know that there are rules about the incidental collection of a PHN under Alberta’s Health Information Act (HIA) that they must follow to avoid collecting, using or disclosing a PHN contrary to these rules. 

Information about how to avoid non-compliance with these Acts as it relates to this personal information is set out below.

Permitted collections of personal information under PIPA

Private sector organizations in Alberta are subject to PIPA.

Under PIPA, they are restricted from collecting any personal information unless they have:

• consent, or authority under PIPA to collect personal information without consent; and
• a reasonable purpose for collecting the personal information.

Even when both these conditions are met, organizations may only collect personal information to the extent necessary for the purpose of the collection. To avoid over-collecting personal information appearing on a driver’s licence or ID card, the organization should implement practices to prevent recording personal information that is not needed.

“Reasonable” is defined in PIPA as “what a reasonable person would consider appropriate in the circumstances”.

Before collecting any personal information on a driver’s licence or ID card, an organization must ensure it has authority to do so under PIPA.

A private sector organization would not generally have authority to make a copy of and keep all the personal information appearing on a driver’s licence or ID card. Organizations should only do so if there is a clear legal obligation to collect and retain this information.

Special considerations for collecting personal health numbers (PHNs)

Alberta’s Health Information Act (HIA) was recently amended to permit the incidental collection of a PHN when a “person”, which includes an organization, has legitimate authority to require an individual to provide their driver’s licence or ID card for specified purposes, including to verify identity, address, or other details, and incidentally collects a PHN when exercising this authority. This is because, as of July 2, 2026, driver’s licences and ID cards issued to Albertans will include PHNs for most people.

Section 21(1) of HIA restricts this “person” from requiring an individual to provide their PHN unless this “person” is a custodian or a prescribed person. The full list of prescribed persons can be found in Section 5 of the Health Information Regulation.

If an organization does not qualify for the exception to the restriction, then it is not allowed to require the provision of a PHN.

Incidental collections of a PHN

Because there will now be more types of personal information on driver’s licences and ID cards than in the past, circumstances may arise where a “person” requires some of the information, but does not require all of it, for example, the PHN. In these instances, this “person” needs to know that there are two circumstances set out in HIA where it may incidentally collect a PHN.

“Person” is defined broadly and includes organizations as defined in PIPA.

“Enactment” is defined in the Interpretation Act. It is an Act or regulation of Alberta. If these sections do not apply, then an organization may only incidentally collect a PHN under section 21.1(2)(b) when it makes a voluntary request for an individual to provide their driver’s licence or ID card for a specified purpose.

If a voluntary request is made, the individual has the right under section 21(3) to refuse to provide their PHN as part of this request. If the individual exercises this right, then the organization must not retain the individual’s PHN. Alternatively, the individual may simply refuse to provide the driver’s licence or ID card to the organization.

In all cases, an organization that incidentally collects a PHN as permitted by HIA is prohibited from using or disclosing the PHN.

Key takeaways

• Organizations must not collect the personal information on a driver’s licence or ID card unless they are permitted by PIPA to do so.
• It is unlikely that an organization would have authority under PIPA to collect citizenship information or PHNs appearing on a driver’s licence or ID card.
• If an organization has authority to collect a PHN under PIPA, it must ensure it also has authority to do so under HIA and then follow the rules under HIA concerning use and disclosure.
• Individuals have the right under HIA to refuse to provide a PHN for any request by an organization to voluntarily provide this information.
• Individuals have the right to make a complaint to the Information and Privacy Commissioner about any practice concerning the collection of personal information that the individual believes is not in compliance with PIPA or HIA.
• The Information and Privacy Commissioner of Alberta oversees compliance with PIPA and HIA and has broad powers to enforce compliance with these Acts.

More Information

If you have any questions about this guidance, please contact generalinfo@oipc.ab.ca.

The OIPC has resources for organizations concerning the collection, use and disclosure of driver’s licences and ID cards by private sector organizations:

Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation

Guidelines for Licensed Premises: Collecting, Using and Disclosing Personal Information of Patrons

Landlords and Tenants: Guidance on PIPA

Guidance on Motor Vehicle Dealership Test Drives

The following Order and Investigation Report address this topic:

Order finding Budget Rent-A-Car of Calgary was not permitted to photocopy a driver’s licence as a condition of renting a vehicle

Investigation Report into Alcanna Inc.’s use of Patronscan identification scanning technology to scan driver’s licences in Edmonton liquor stores

Below are some additional orders and investigation reports issued by the OIPC relevant to collecting driver’s licence information in various ways by organizations subject to PIPA.

P2008-IR-002 (DeVry Institute of Technology’s requirement to photocopy identity cards, including driver’s licences, in connection with potential future loans for tuition applications processed by a third party)

P2007-016 (Home Depot’s practice of collecting and retaining driver’s licences as part of its refund policy)

P2006-011 (Tantra Nightclub scanning driver’s licences on entry)

P2005-IR007 (certain Canadian Tire stores photocopying driver’s licences as part of their return policy)

July 2026

Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.

Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.

Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.

What public bodies need to know about this change

Public bodies need to know that the addition of this information to driver’s licences and ID cards may result in overcollection of personal information by these organizations under Alberta’s Protection of Privacy Act (POPA), specifically citizenship information and PHNs.

Permitted collections of personal information under POPA

Public bodies in Alberta are subject to Alberta’s Protection of Privacy Act (POPA). Under POPA there are just three circumstances that permit the collection of personal information by a public body. They are set out in POPA as follows:

More about the term “expressly authorized”

The OIPC has interpreted “expressly authorized” to mean “definitely stated, not merely implied”. POPA section 4(a) can only be relied on by a public body to collect personal information if an Act or regulation of Alberta or Canada states that it, the public body, is authorized to collect the specific information being collected. It is not enough for the Act or regulation to merely imply authorized collection.

In order to rely on section 4(a) in the context of collecting the personal information on a driver’s licence or ID card, the Act or regulation must authorize the specific public body to collect this specific personal information. If an Act or regulation sets out this authority, then only that personal information that is expressly authorized by the Act or regulation may be collected and no more.

There may be Acts or regulations requiring a public body to record the information on a driver’s licence or ID card, including for the purposes of demonstrating citizenship, which may authorize a public body to collect this information. However, it is unlikely that this section could be relied on by a public body to record a PHN.

When relying on section 4(a), public bodies must take steps to ensure not to collect more information appearing on a driver’s licence or ID card than is authorized or required by the Act or regulation to collect.

More about “the purposes of law enforcement”

Section 4(b) of POPA permits a public body to collect personal information if “that information is collected for the purpose of law enforcement”. “Law enforcement” is defined in section 1(1)(k) of POPA as follows.

There may be circumstances where a public body needs to make a record of a driver’s licence or ID card, rather than just viewing the document, for a law enforcement purpose. Where this collection is permitted, public bodies should take care to only collect that information on the driver’s licence or ID card that is required for the law enforcement purpose.

More about “an operating program or activity of a public body”

Section 4(c) permits a public body to collect personal information if “that information relates directly to and is necessary for an operating program or activity of the public body, including a common or integrated program or service”.

There may be circumstances where a public body needs to make a record of a driver’s licence or ID card, rather than just viewing the document, for an operating program or activity of a public body. When relying on section 4(c) to make a record of a driver’s licence or ID card, the public body must ensure that only that personal information on a driver’s licence that “relates directly to and is necessary” for the operating program or activity is collected. Any collection beyond this is unauthorized.

On rare occasions, a public body may have authority under this section to collect a citizenship marker. It is highly unlikely that a public body would have authority under this section to collect a PHN.

Direct collection and notice of collection

Public bodies are required to collect personal information directly from the individual whom the information is about, unless an exception to this requirement exists.

When collecting personal information directly from an individual, public bodies are required to give notice to the individual about the collection. The notice must include: the purpose for the collection; the specific legal authority for the collection; contact information for the public body’s privacy officer so the individual can enquire about the collection; and the public body’s intention, if any, to input the information into an automated system for certain specified activities.

This notice requirement is mandatory unless the “head” of the public body is of the opinion that giving notice could reasonably be expected to result in the collection of inaccurate information. This exception would likely not apply when making a record of a driver’s licence or ID card.

Special considerations for collecting a PHN

Alberta’s Health Information Act (HIA) was recently amended to permit the incidental collection of a PHN when a “person”, which includes a public body, has legitimate authority to require an individual to provide their driver’s licence or ID card for specified purposes, including to verify identity, address, or other details, and incidentally collects a PHN when exercising this authority. This is because, as of July 2, 2026, driver’s licences and ID cards issued to Albertans will include PHNs for most people.

Permitted collection of a PHN under HIA

Section 21(1) of HIA restricts a “person” from requiring an individual to provide their PHN unless this “person” is a custodian or a prescribed “person”. The full list of prescribed persons can be found in Section 5 of the Health Information Regulation.

If a public body does not qualify for the exception to the restriction, then it is not allowed to require the provision of a PHN.

Incidental collections of a PHN

Because there will now be more types of personal information on driver’s licences and ID cards than in the past, circumstances may arise where a “person” requires some of the information, but does not require all of it, for example, the PHN. In these instances, this “person” needs to know that there are two circumstances set out in HIA where it may incidentally collect a PHN.

If these sections do not apply, then a public body may only incidentally collect a PHN under section 21.1(2)(b) when it makes a voluntary request for an individual to provide their driver’s licence or ID card for a specified purpose.

If a voluntary request is made, the individual has the right under section 21(3) to refuse to provide their PHN as part of this request. If the individual exercises this right, then the public body must not retain the individual’s PHN. Alternatively, the individual may simply refuse to provide the driver’s licence or ID card to the public body.

In all cases, a public body that incidentally collects a PHN as permitted by HIA is prohibited from using or disclosing the PHN.

Key takeaways

• Public bodies must not collect personal information on a driver’s licence or ID card unless they are permitted by POPA to do so.
• For certain activities, such as law enforcement or to establish eligibility for certain government programs or services, public bodies may be authorized by POPA to collect citizenship information that appears on a driver’s licence or ID card. However, collection of a PHN may not be permitted and should be avoided.
• If a public body has authority to collect a PHN under POPA, it must ensure it also has authority to do so under HIA and follow the rules under HIA concerning use and disclosure.
• Individuals have the right under HIA to refuse to provide a PHN for any request by a public body to voluntarily provide this information.
• Individuals have the right to make a complaint to the Information and Privacy Commissioner about any collection of this information that the individual believes is not in compliance with POPA or HIA.
• The Information and Privacy Commissioner of Alberta oversees compliance with POPA and HIA and has broad powers to enforce compliance with these Acts.

More Information

If you have any questions about this guidance, please contact generalinfo@oipc.ab.ca.

[1] In Alberta’s Interpretation Act, “enactment” means an Act or a regulation or any portion of an Act or regulation. “Act” means an Act of the Legislature and includes an Ordinance of the North-West Territories in force in Alberta. “Legislature” means the Lieutenant Governor acting by and with the advice and consent of the Legislative Assembly.  An enactment of Alberta is, therefore, an Alberta law or regulation. In the federal Interpretation Act, “enactment” means an Act or regulation or any portion of an Act or regulation, and “Act” means an Act of Parliament.

July 2026

It is common for prospective buyers to want to test drive vehicles they are considering to purchase, before they make their final decision. When a prospective buyer takes a vehicle from a motor vehicle dealership out on the road for a test drive, there are a number of risks that dealerships may face, from receiving violation tickets, to damages, or to the extreme, theft of the vehicle.

While motor vehicle dealers have a need to collect personal information due to the risks noted above, they must ensure that their collection of personal information about drivers complies with Alberta’s privacy legislation.

This document was prepared by the Office of the Information and Privacy Commissioner (OIPC) to provide practical guidance to motor vehicle dealership owners and employees regarding the collection, use, disclosure and retention of personal information related to test drives.

In Alberta, the Personal Information Protection Act (PIPA) governs how you, as a motor vehicle dealership owner or employee, can collect, use, disclose and retain the personal information of individuals.

Do you have to tell individuals you are collecting their personal information?

Before, or at the time information about individuals is collected, a dealership:

• must notify individuals, orally or in writing, of its purpose for collecting the information;
• must clearly specify that it is requesting the information for identification purposes;
• must identify any other purpose, if applicable, and obtain consent; and
• must provide the name or title of a person who is able to answer questions on behalf of the dealership about the collection.

Do you need to get consent to collect personal information from individuals?

Before collecting personal information of an individual asking to test drive a vehicle, a dealership must first obtain consent. Consent may be given in writing, orally, or by electronic means. However, dealerships need to consider how they will keep a record and how individuals can withdraw their consent. Please refer to the OIPC website for the guidance document on consent titled “PIPA Advisory 1 – Consent” that can be found at
www.oipc.ab.ca.

What personal information can you collect?

PIPA limits the personal information dealerships can collect, stating that information can be collected only for purposes that are reasonable and only the information that is reasonably required for meeting the intended purposes. PIPA defines “reasonable” as “what a reasonable person would consider appropriate in the circumstances”.

In relation to test drives, this means dealerships should collect only first name, last name, address and driver’s licence number. Specifically, they must not make or keep paper or electronic copies of the drivers’ licences of test drivers.

How about using the information collected?

Just like dealerships may collect only the least amount of information, they may use the personal information collected only for purposes individuals agreed to, or as authorized by law. Specifically, dealerships must not make secondary uses of the information, such as using it for marketing purposes, unless they have consent from the individuals to do so.

Who can you share this information with?

Finally, dealerships must not disclose to third parties the personal information of individuals collected for a test drive, unless authorized by law, or with the consent of these individuals.

How long should you keep the information?

Under PIPA, dealerships have an obligation to maintain accurate records of information. Dealerships may retain this information only as long as reasonably required for legal and business purposes. For example, a dealership should determine the length of time it is required to retain the information to address the risks it identified, and set the retention based on that. It is recommended that dealerships draft a policy that specifies the adequate retention period, make the policy available to employees, customers, and the public. Dealerships should also designate someone as responsible to periodically and securely dispose of records at the end of the stated retention period.

In Order P2012-10, the OIPC found that a car rental agency had no reasonable purpose to photocopy and keep photocopies of the drivers’ licences of renters. The Adjudicator determined that simply verifying the licence and recording its number, with name and address of the renter was adequate to address issues of vehicle theft without photocopying the licence.

Do you have to protect the personal information you collected?

Throughout the lifecycle of the information, from collection to destruction, dealerships must make reasonable security arrangements to protect it. This is a requirement under PIPA and it applies regardless of the format of the records. For example, this means restricting access to the information to only those staff members with “a need to know”, storing paper records in a locked cabinet, and encrypting electronic devices that contain personal information.

If dealerships become aware of the loss, unauthorized access, or disclosure of personal information, they must notify the OIPC where there is a real risk of significant harm to individuals.

For more information on breach notification, please visit our website at www.oipc.ab.ca.

Who can you contact?

Dealerships are encouraged to contact the OIPC and to view the OIPC website for more information about complying with PIPA.