Can My Business Collect and Record Driver’s Licences?

Many businesses seek to collect some form of identification, such as driver’s licences, from customers in one way or another.

However, before you request copies of your customers’ driver’s licences, you will need to consider the laws that affect what you can collect and how you should collect this information. This article will explain:

• the privacy laws surrounding the collection of identity documents;
• why sensitive information requires extra protection; and
• what your privacy policy needs to cover. 

Compliance with the Privacy Act

Your business will be required to comply with the Privacy Act if it is considered an ‘APP entity’. APP entities are businesses which: 

• have an annual turnover of more than $3 million;
• trade in personal information;
• provide a health service; or
• contract with the government.

The Privacy Act regulates how businesses handle personal information. Personal information includes the information that typically appears on driver’s licences, such as an individual’s: 

• name;
• address; 
• date of birth; and 
• other sensitive information (discussed below). 

If you are not an APP entity, compliance with the Privacy Act is a matter of best practice. However, many businesses decide to opt-in to compliance. Although you do not actually have any obligations to comply with the Privacy Act, this could change for you in the future if:

• there is a change in the way your business operates; or
• your business grows and you meet the annual turnover threshold. 

When Can You Collect Information?

Collecting unnecessary personal information is a breach of the Privacy Act. Under the law, you should not scan, copy or email a customer’s driver’s licence if having an employee or representative sight it would be sufficient. 

However, the Privacy Act does allow you to take a copy of ID documents if it is reasonably necessary to do so.

If you do not fall into this category, however, you will have to assess whether it is necessary for you to scan such documents. 

Collection of Sensitive Information 

Identification documents and driver’s licences sometimes contain sensitive information, which is a special category of personal information.

For example, sensitive information includes information about an individual’s:

• race or ethnic origin;
• political opinions or membership of a political organisation;
• religious beliefs and affiliations;
• sexual preferences and orientation;
• criminal record; and
• health information.

Sensitive information is given extra protection under the Privacy Act. In some circumstances, a licence will reveal sensitive information about an individual. 

If this is the case, you can only scan it if it is reasonably necessary for your business purposes and you have the individual’s consent. 

If you are unsure whether it is necessary to scan an ID, you should consider whether you:

• could explain to a customer why sighting their ID is insufficient; and
• would be able to explain why you did not merely sight the ID without scanning it if a complaint was made.

If possible, the simplest option is to sight the driver’s licence without scanning it. However, you do not need to comply with these recommendations if you are not an APP entity. In this case, you should consider compliance a matter of best practice. 

What Does Your Privacy Policy Need to Set Out? 

Your privacy policy needs to clearly set out how and why you collect the information on drivers’ licences. For example, it should include:

• what personal information you collect (including information on scanned or copied identification documents);
• why you collect, hold and use the information; 
• what security measures you have in place to protect any information you store electronically;
• how long you keep the information for; and
• how you will erase or remove the information after a certain time period. 

Key Takeaways 

The Privacy Act contains strict rules about how you can collect and deal with driver’s licences and other forms of identity documents. If you are an APP entity, you must comply with these obligations. Although you do not need to do so if you are not an APP entity, compliance is a matter of best practice. If you need assistance with complying with the Privacy Act or updating your privacy policy, contact LegalVision’s privacy lawyers on 1300 544 755 or fill out the form on this page.