If your business scans customer ID, this one is about you. On September 21 the Office of the Privacy Commissioner of Canada opened a formal investigation into IDScan.net, a Louisiana company whose software and hardware verify identity documents for bars, nightclubs, car rental counters and cannabis retailers. An unauthorized third party got into the company database and stole personal information, including digital scans of driver's licences. Reports put the exposure at more than 153 million licence records across Canada and the United States. The number is not the interesting part. What the Commissioner says he will examine is.
What the OPC is actually looking at
Two things, and the second one catches people off guard. First, the security safeguards IDScan.net had in place at the time of the breach, which is the standard question under PIPEDA, Canada's federal private-sector privacy law. Second, the adequacy of its notifications to affected individuals. Read that again: telling people badly is its own compliance problem, separate from getting breached in the first place. Under PIPEDA you have to notify the Commissioner and affected individuals when a breach creates a real risk of significant harm, and you have to keep a record of breaches even when it does not.
Why a scanned licence is worse than a stolen password
A password takes a minute to change. A driver's licence takes years to expire. A scan usually captures the full document image plus name, address, date of birth, licence number and expiry date, which is close to everything needed to open an account in someone else's name, pass a knowledge-based identity check, or assemble a synthetic identity out of real pieces. It also makes phishing far more convincing, because the person on the other end can prove they know things about you that a stranger should not.
The part that applies to your business
Very few small businesses build ID-scanning software. Plenty of them use it. If you check ID at the door, at a rental counter, at a dispensary till, or as part of verifying a client you onboard remotely, you are the organization that collected that information. Your customer handed the licence to you, not to a software company in another country. Canadian privacy law does not transfer your accountability to a vendor just because the vendor is the one storing the file. That is the point of assessing a vendor before you sign and of getting the data terms in writing, and it is the reason a breach at a supplier can land on your desk.
What to actually do
- Find out where the scans go. Ask your vendor in writing whether document images are retained, for how long, in which country, and who can access them. Many ID tools have a setting that discards the image once the check passes. If yours does, turn it on.
- Collect less. Confirming someone is of legal age does not require keeping a copy of their licence. A record that says verified, over the age limit, on this date is usually all the proof you need.
- Check the contract. Breach notification timelines, security commitments and deletion obligations belong in the agreement, not in a sales email.
- Know your own notification duty. If a vendor loses data you collected, you may still owe an assessment of real risk of significant harm and possibly a notification of your own. Do not assume the vendor speaks for you.
- Write down what you decided. A short record of what you collect, why, and how long you keep it is the difference between a defensible answer and a scramble.
The takeaway
Identity verification is one of those jobs small businesses quietly outsource to a box on the counter and never think about again. This investigation is a reminder that the data stays yours in the eyes of the regulator, and that how you handle the aftermath is being judged as closely as how you handled the security. Both are fixable in an afternoon of decisions, well before anyone is asking.