Your Driver’s Licence Could Be More Valuable Than Your Password
Imagine showing your driver's licence at a bar, hotel or business for a quick identity check.
You probably expect someone to confirm your age or identity, hand the card back and move on.
But what happens when a company involved in verifying those IDs suffers a data breach and digital copies of government identification are accessed by an unauthorized third party?
Canada is now investigating exactly that.
Canada Opens Investigation
On September 21, Canada's Privacy Commissioner Philippe Dufresne announced an investigation into IDScan.net following reports that an unauthorized third party accessed the company's database.
According to the Office of the Privacy Commissioner of Canada, the compromised information included digital scans of driver's licences and other forms of identification.
IDScan.net provides identity-verification technology used by businesses, including hospitality and nightlife establishments, to verify customers' identities.
The investigation will examine the safeguards IDScan had in place to protect personal information. The Privacy Commissioner's office will also examine whether affected individuals received adequate notification and whether the company complied with Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA.
How Many Canadians Were Affected?
This remains one of the biggest unanswered questions.
The Office of the Privacy Commissioner has not publicly disclosed how many Canadians were affected by the breach.
That distinction is important because large numbers circulating publicly about IDScan's database should not automatically be treated as the confirmed number of breach victims.
At this point, Canada's federal privacy regulator has confirmed an investigation involving compromised identification information, but it has not announced a Canadian victim count.
Why Stolen ID Scans Are Different
A compromised password can usually be changed.
A driver's licence is much more complicated.
Government-issued identification can contain several pieces of identifying information, potentially including a person's name, photograph, date of birth, address and identification number.
When this information is compromised, it can create risks involving identity theft, fraud and impersonation.
That makes breaches involving identity-verification companies particularly concerning. These companies can handle sensitive identification documents because other businesses rely on them to determine whether customers are who they claim to be.
In other words, technology designed to help prevent identity fraud can itself become an attractive target when large amounts of identification data are stored together.
Canada Wants Answers
The Office of the Privacy Commissioner says it had already been engaging with IDScan after the company issued a public advisory about the incident earlier in September.
The regulator says it will continue working with the company to ensure necessary steps are taken to address the incident and mitigate risks to Canadians.
Because the investigation remains active, the Privacy Commissioner's office says it cannot currently provide additional details.
That leaves Canadians with one particularly important unanswered question:
How many Canadian identification documents were actually compromised?
For now, there is no publicly confirmed Canadian number.
What is confirmed is serious enough: Canada's federal privacy regulator is formally investigating a breach involving digital copies of government-issued identification — information that can be considerably more difficult to replace than an ordinary password.