Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.

Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.

Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.

What does this mean for the privacy of this sensitive personal information?

Driver’s licences and ID cards are used for a variety of purposes. Having more information on these cards means that this additional personal information may be collected by those persons or bodies to whom you provide your driver’s licence or ID card, as may be required by law or where requested voluntarily for identification or other legitimate purposes.

The Information and Privacy Commissioner of Alberta is responsible to monitor compliance with Health Information Act (HIA), the Personal Information Protection Act (PIPA), and the Protection of Privacy Act (POPA).

HIA applies to custodians, including your doctor and other health professionals, as well as larger health institutions, such as hospitals. PIPA applies to private sector organizations, such as law firms, retailers, liquor stores, and bars. POPA applies to public bodies, including government departments and law enforcement agencies.

Collection by custodians – HIA

Custodians are permitted to collect your personal health number to provide you with health services.

It is unlikely that a custodian would be permitted under the HIA to record the other information appearing on your driver’s licence or ID card, including your citizenship marker. This is because HIA restricts the type of health information that custodians can collect.

If a custodian makes a copy of your driver’s licence or ID card, you should ask what their authority is to collect all the information on the driver’s licence or ID card.

If you have concerns about unauthorized collection of the information on your driver’s licence or ID card, you should address your concern with the custodian.

If you are not satisfied with the custodian’s response, you may make a complaint to the OIPC.

Collection by private sector organizations – PIPA

Private sector organizations would not generally have authority under PIPA to make a copy of your driver’s licence or ID card, unless there is a legal requirement by this organization to collect this information in this manner. Instead, in most cases, individuals may display the driver’s licence or ID card to verify identity or age, without the need for a copy to be made.

PIPA limits what personal information an organization may collect. It is unlikely that an organization under PIPA would have authority to collect your personal health number or citizenship marker.

If an organization under PIPA asks to make a copy of your driver’s licence or your ID card, or makes a copy of these documents, ask them for their authority under PIPA to do this. If you have concerns about this, ask for the name of their privacy officer to discuss this authority. You may make a complaint to the privacy officer if you suspect non-compliance with PIPA for this practice.

If you are not satisfied with the organization’s response, you may make a complaint to the OIPC.

Collection by public bodies – POPA

Public bodies would only be permitted to make a copy of your driver’s licence or ID card if they are permitted to do so as part of delivering a program or service, or if authorized by law. Instead, in most cases, individuals may display the driver’s licence or ID card to verify identity or age, without the need for a copy to be made.

There are some programs and services of government that require you to prove your citizenship. A public body may be able to collect this information from your driver’s licence or ID card without taking a copy. It will depend on the program or service requirements. It is unlikely that a public body would have authority to collect your personal health number.

If a public body asks to make a copy of your driver’s licence or your ID card, or makes a copy of these documents, ask them for their authority under POPA to collect all the information on your driver’s licence or ID card. If you have concerns about this, ask for the name of their privacy officer to discuss this authority. You may make a complaint to the privacy officer if you suspect non-compliance with POPA for this practice.

If you are not satisfied with the public body’s response, you may make a complaint to the OIPC.

Additional steps you can take to protect your personal information on your driver’s licence or ID Card

Consider obscuring unnecessary information on your driver’s licence or ID card before a copy is made or the document is viewed. When doing this, take care not to damage the card.

Before a person makes a copy, ask the person to obscure unnecessary information so that only the information that is required from the card is copied.

You may also consider covering up certain personal information, such as your citizenship marker or your personal health number, prior to showing your driver’s licence or ID card to any person.

Things to remember

Take extra precautions when providing your driver’s licence or ID card when you are travelling outside of Alberta because Alberta’s privacy laws do not apply in this circumstance. However, other privacy laws may apply.

Alberta’s privacy laws do apply when you provide your driver’s licence or ID card while you are in Alberta to an organization operating outside of Alberta, such as may be the case for online activities.

July 2026

Driver’s licences and ID cards will display a Canadian citizenship marker for Alberta residents who are Canadian citizens and will be modernized for improved protection against identity fraud.

Eligible Canadian citizens and permanent residents with existing Alberta Health Care Insurance Plan coverage, who are renewing their driver’s licence or ID card or obtaining one for the first time, will have their Personal Health Number (PHN) added. This is a mandatory requirement.

Albertans will be required to go to a registry office to renew their driver’s licences and ID cards.

What private sector organizations need to know about this change

Private sector organizations need to know that the addition of this information to driver’s licences and ID cards may result in overcollection of personal information by these organizations under Alberta’s Personal Information Protection Act (PIPA), specifically citizenship information and PHNs.

Private sector organizations also need to know that there are rules about the incidental collection of a PHN under Alberta’s Health Information Act (HIA) that they must follow to avoid collecting, using or disclosing a PHN contrary to these rules. 

Information about how to avoid non-compliance with these Acts as it relates to this personal information is set out below.

Permitted collections of personal information under PIPA

Private sector organizations in Alberta are subject to PIPA.

Under PIPA, they are restricted from collecting any personal information unless they have:

• consent, or authority under PIPA to collect personal information without consent; and
• a reasonable purpose for collecting the personal information.

Even when both these conditions are met, organizations may only collect personal information to the extent necessary for the purpose of the collection. To avoid over-collecting personal information appearing on a driver’s licence or ID card, the organization should implement practices to prevent recording personal information that is not needed.

“Reasonable” is defined in PIPA as “what a reasonable person would consider appropriate in the circumstances”.

Before collecting any personal information on a driver’s licence or ID card, an organization must ensure it has authority to do so under PIPA.

A private sector organization would not generally have authority to make a copy of and keep all the personal information appearing on a driver’s licence or ID card. Organizations should only do so if there is a clear legal obligation to collect and retain this information.

Special considerations for collecting personal health numbers (PHNs)

Alberta’s Health Information Act (HIA) was recently amended to permit the incidental collection of a PHN when a “person”, which includes an organization, has legitimate authority to require an individual to provide their driver’s licence or ID card for specified purposes, including to verify identity, address, or other details, and incidentally collects a PHN when exercising this authority. This is because, as of July 2, 2026, driver’s licences and ID cards issued to Albertans will include PHNs for most people.

Section 21(1) of HIA restricts this “person” from requiring an individual to provide their PHN unless this “person” is a custodian or a prescribed person. The full list of prescribed persons can be found in Section 5 of the Health Information Regulation.

If an organization does not qualify for the exception to the restriction, then it is not allowed to require the provision of a PHN.

Incidental collections of a PHN

Because there will now be more types of personal information on driver’s licences and ID cards than in the past, circumstances may arise where a “person” requires some of the information, but does not require all of it, for example, the PHN. In these instances, this “person” needs to know that there are two circumstances set out in HIA where it may incidentally collect a PHN.

“Person” is defined broadly and includes organizations as defined in PIPA.

“Enactment” is defined in the Interpretation Act. It is an Act or regulation of Alberta. If these sections do not apply, then an organization may only incidentally collect a PHN under section 21.1(2)(b) when it makes a voluntary request for an individual to provide their driver’s licence or ID card for a specified purpose.

If a voluntary request is made, the individual has the right under section 21(3) to refuse to provide their PHN as part of this request. If the individual exercises this right, then the organization must not retain the individual’s PHN. Alternatively, the individual may simply refuse to provide the driver’s licence or ID card to the organization.

In all cases, an organization that incidentally collects a PHN as permitted by HIA is prohibited from using or disclosing the PHN.

Key takeaways

• Organizations must not collect the personal information on a driver’s licence or ID card unless they are permitted by PIPA to do so.
• It is unlikely that an organization would have authority under PIPA to collect citizenship information or PHNs appearing on a driver’s licence or ID card.
• If an organization has authority to collect a PHN under PIPA, it must ensure it also has authority to do so under HIA and then follow the rules under HIA concerning use and disclosure.
• Individuals have the right under HIA to refuse to provide a PHN for any request by an organization to voluntarily provide this information.
• Individuals have the right to make a complaint to the Information and Privacy Commissioner about any practice concerning the collection of personal information that the individual believes is not in compliance with PIPA or HIA.
• The Information and Privacy Commissioner of Alberta oversees compliance with PIPA and HIA and has broad powers to enforce compliance with these Acts.

More Information

If you have any questions about this guidance, please contact generalinfo@oipc.ab.ca.

The OIPC has resources for organizations concerning the collection, use and disclosure of driver’s licences and ID cards by private sector organizations:

Collection of Driver’s Licence Numbers Under Private Sector Privacy Legislation

Guidelines for Licensed Premises: Collecting, Using and Disclosing Personal Information of Patrons

Landlords and Tenants: Guidance on PIPA

Guidance on Motor Vehicle Dealership Test Drives

The following Order and Investigation Report address this topic:

Order finding Budget Rent-A-Car of Calgary was not permitted to photocopy a driver’s licence as a condition of renting a vehicle

Investigation Report into Alcanna Inc.’s use of Patronscan identification scanning technology to scan driver’s licences in Edmonton liquor stores

Below are some additional orders and investigation reports issued by the OIPC relevant to collecting driver’s licence information in various ways by organizations subject to PIPA.

P2008-IR-002 (DeVry Institute of Technology’s requirement to photocopy identity cards, including driver’s licences, in connection with potential future loans for tuition applications processed by a third party)

P2007-016 (Home Depot’s practice of collecting and retaining driver’s licences as part of its refund policy)

P2006-011 (Tantra Nightclub scanning driver’s licences on entry)

P2005-IR007 (certain Canadian Tire stores photocopying driver’s licences as part of their return policy)

July 2026