You may want to collect driver licence details for identification confirmation purposes, such as verifying age. However, driver licences are a form of personal information because you can identify the person they are about. Therefore, when you collect this personal information, you must comply with New Zealand privacy law as an agency. If this kind of sensitive personal information gets into the wrong hands, it could mean serious harm for an individual. For that reason, you need to ensure you handle driver licence information carefully. Furthermore, you should only collect it when you need it. For some guidance, this article will explain circumstances where you can collect and keep driver licence details in New Zealand.
Driver Licences as Unique Identifiers
Under the Privacy Act, driver licence numbers are a kind of unique identifier. These are usually a string of numbers and letters unique to one person, which you cannot assign to anyone else. Other examples of unique identifiers include:
- passport numbers;
- IRD numbers;
- student ID numbers; or
- bank customer numbers.
Depending on the nature of the unique identifier, these can be highly sensitive forms of personal information. Due to this, malicious third parties are more likely to use them for identity fraud. Therefore, a data breach involving unique identifiers is a serious issue. Furthermore, it is not as easy to change identity information as it is to change other kinds of personal information, such as credit card details.
For example, if an unauthorised third party gets a hold of one of your customers’ driver licence details, they can pass themselves off as that person in some cases. They can then potentially get access to that customer’s financial details or other sensitive information.
Therefore, the Privacy Act sets additional rules for businesses and organisations that want to collect or keep unique identifiers, including driver licence details.
Your Responsibilities When Collecting Driver Licence Details
You cannot collect a unique identifier from your customers unless that was the reason your customers have that particular number or a reason directly relating to that original purpose. Additionally, you can only collect personal information for a necessary and lawful business purpose. Therefore, before collecting any personal information, particularly unique identifiers, you need to define this purpose.
For example, if you hire delivery drivers, it is reasonable to collect their driving licence details to confirm they can drive your motor vehicles.
Regarding collecting driver licence details, verifying your individuals’ identity will usually come under both of these requirements. You may need to verify their identity for reasons such as:
- proof of purchase;
- proof of age;
- confirming a valid driving licence; or
- checking that they can drive with the appropriate licence class.
What You Need to Tell People
When you collect driver licence details, you need to tell people a few things so that they know how you will handle their personal information. You or your staff need to tell them:
- why you are collecting their identity information;
- what you will do with this information;
- how long you will keep their driver licence details for;
- whether you are copying their driver licence; and
- who you will share this information with.
Your privacy policy should also include these details and other important information, such as how you will secure their driver licence details.
Do You Need to Keep Driver Licence Details?
A key point regarding collecting and storing driver licence information is whether you need to retain it at all. If simply seeing the driver licence to confirm identity is sufficient, you should not copy or record it in any way. Therefore, to determine whether you need to keep driver licence details, you need to have an identifiable and justifiable reason to do so.
For example, some industries require you keep identity information. Financial services need to keep identity verification information for at least five years after a business relationship has ended to prevent money laundering.
If you cannot explain to a customer why you need to keep their driver licence details, then you do not have a legitimate reason to do so.
Securing Driver Licence Details
When you do have a legitimate reason to keep records of driver licence details, you need to take steps to secure these appropriately against:
- loss;
- misuse; or
- unintended disclosure.
Encrypt any connections where people give you their driver licence details and any personal data itself. Additionally, consider whether you can de-identify any of the information you store.
Key Takeaways
Driver licence numbers are unique identifiers. Therefore, you can only collect these details and keep this information when you have a necessary and lawful reason. If you would like more information or help determining when you can collect and keep driver licence details, contact LegalVision’s privacy lawyers on 0800 005 570 or fill out the form on this page.
Frequently Asked Questions
Unique identifiers are usually a set of numbers and letters that a business or organisation assigns to a specific person, which only applies to them. They are a form of personal information, so privacy law protects them.
You can only collect and keep driver licence details, such as driver licence numbers, when you have a lawful and legitimate reason to do so. You need to identify this reason before you collect these details.
We appreciate your feedback – your submission has been successfully received.
