Bye, Bye Dino: What the Redesigned Alberta Driver's Licence Means for Employer Privacy Obligations

On July 2, 2026, the Government of Alberta introduced a new, much-anticipated design for provincial driver’s licences. And while much has been made of the visual changes—gone is the beloved Albertosaurus that was a feature since the 2018 redesign—the inclusion of a Canadian citizenship marker and a personal health number also raises fresh privacy management considerations for employers.

On a practical level, the addition of personal heath number (PHN) and citizenship information on individuals’ driver’s licences creates tangible privacy management risks for employers who regularly collect employee identification information as part of their operations. New guidance from the Office of the Information and Privacy Commissioner of Alberta (“OIPC”) regarding the collection and management of personal information by public and private sector organizations suggests that employers may have to make changes to their practices to ensure employee personal information is protected.[1]

The changes

Driver's licences and ID cards issued or renewed from July 2, 2026, onward will display a citizenship marker for Alberta residents who are Canadian citizens. Eligible Canadian citizens and permanent residents will also have their PHN added to the document as a mandatory feature. Individuals must now attend a registry office in person to renew these documents, rather than renewing online.

Why this matters

As a starting point, PHN’s are only legally allowed to be collected by certain organizations for certain purposes. Now that the PHN is found on an individual’s driver’s licence—a document which is regularly used by individuals to confirm identity, age, address or legal ability to drive—organizations which retain copies of driver’s licences risk the over collection of personal information.

1. For custodians and prescribed “persons” under the HIA

   The changes are enabled by recent legislative amendments, including those made to the Health Information Act (“HIA”) by the Health Statutes Amendment Act. Under the amendments to the HIA, custodians or “prescribed persons” are permitted to collect an individual’s PHN where it is required to provide a health service, conduct research, or otherwise authorized by law. “Prescribed persons” under the Health Information Regulation include insurers, ambulance attendants, Workers' Compensation Board officials, and certain ministerial officials, amongst others.

   The amendments further allow for the collection of a PHN where it is voluntarily provided and incidental to the collection of an individual’s driver licence for an unrelated purpose that is otherwise authorized by law, such as establishing identity, confirming addresses, etc. That said, a PHN that is incidentally collected by a custodian or prescribed person must not be used or disclosed, as per the requirements under the HIA. None of the changes to the HIA specifically allow a custodian that is also an employer to collect the PHN of its employees. Collection of a PHN must remain tied to the provision of a health service or other permitted use, which does not include employment matters.

2. For private sector organizations

   The Personal Information Protection Act (“PIPA”) remains the operative statute for the management and collection of personal information by private sector organizations. PIPA allows organizations to collect personal information with or without consent (depending upon the circumstances) where there is a reasonable purpose for the collection. Employers are allowed to collect the personal information of employees where it is reasonably required for the purposes of establishing, managing or terminating the employment relationship, or managing a post-termination relationship.

   Currently, when an employee is required to drive as part of their job duties, many employers ask for and retain a copy of the employee’s driver’s licence in the employee’s file. However, as per the OIPC’s guidance, organizations will rarely have authority under PIPA to photocopy or otherwise retain copies of an individual’s driver's licence or ID card, which now include citizenship markers and PHNs.

3. For public sector organizations

For public bodies, the Protection of Privacy Act (“POPA”) governs the management and collection of personal information. In particular, POPA permits public bodies to collect personal information only where it is “expressly authorized” by statute. For public bodies who are employers, the collection of personal information from employees is authorized when it is directly related and necessary for the operation of a program or activity by the public body. As in the case of private sector organizations, public body employers are allowed to confirm an employee’s legal ability to drive when required, however, the collection of an individual’s PHN will rarely be justified.

Practical implications

There are several practical effects for public and private sector employers as a result of the changes to provincial driver’s licences and ID cards. For one, employers should take care to review their existing identity verification practices to ensure that they are statutorily compliant. Staff collecting personal information should be provided with direction as to what information may be viewed and recorded, as well as how to respond to questions from employees regarding an organization's authority to collect personal information (which is an explicit right of individuals under the legislation).

In the case of employers who regularly retain copies of employees’ driver's licence information as part of their personnel file, the recent design changes may require information collection practices to be revisited in the following respects:

• Retention – Organizations must determine to what extent copies of employees’ driver’s licences need to be retained, if at all. As previously mentioned, organizations governed under PIPA must ensure that the collection of personal information is limited to what is reasonably necessary for an identified purpose. Where, for example, the purpose is simply to confirm that an employee holds a valid licence, it may be sufficient to simply review the original and record the licence number, class, and expiry date without retaining a photocopy or scan. Any photocopying and retention of driver’s licence information should be reserved for situations where there is a specific need to do so, such as where the employer operates in a regulated industry with statutory record-keeping requirements;
• Redactions – It is advisable for employers to redact the PHN from any retained copies of employee driver’s licences. Confirming an employee’s identity or the validity of their licence generally does not require referencing their PHN, such that retaining unredacted copies of driver’s licences may create unnecessary exposure under privacy legislation, particularly where there is no corresponding business purpose. It is worth re-emphasizing that the PHN is sensitive health information whose collection is only permitted where it is provided voluntarily and authorized by statute, even where it is collected incidentally;
• Citizenship marker – The inclusion of a citizenship marker on individual driver’s licences raises nuanced considerations for employers as they relate to the management of employee personal information. On one hand, employers have a legitimate interest in confirming an employee’s eligibility to work and, in some cases, may even face penalties for knowingly employing individuals not authorized to work in Canada. That said, it is unclear if the newly-included citizenship marker is the only—let alone the best—means of confirming an individual’s eligibility to work in Canada. Permanent residents, protected persons, and holders of a valid work permit are equally entitled to work in Canada despite not having a citizenship marker on their driver’s licence or ID card. Employers should therefore favour reviewing an individual’s Social Insurance Number or relevant immigration documentation when determining their work authorization, as such documents are more generally informative than a citizenship marker. Employers that treat the absence of a citizenship marker as a basis for hiring decisions may also expose themselves to claims under the Alberta Human Rights Act, which prohibits discrimination based on an individual’s place of origin.

Recommended steps

Employers should consider the following steps in light of the changes to provincial identification documents and the relevant OIPC guidance:

• Review current identification and verification procedures to confirm that they do not require collecting, copying, or recording citizenship markers or PHNs, unless there is a specific statutory basis for doing so;
• In the case of employee licence checks, consider replacing photocopying practices with an approach where identifying documents are simply reviewed and relevant eligibility requirements are separately confirmed, such as in the form of a checklist;
• Where the circumstances require that a copy of an employee’s driver's licence or ID card be retained, information such as the PHN should be redacted before filing. Organizational scanning and photocopying procedures should also be updated accordingly;
• Legal work authorizations should be verified using an employee’s Social Insurance Number and/or relevant immigration documentation rather than a driver's licence citizenship marker. Furthermore, human resources personnel should be instructed not to regard the absence of a citizenship marker as evidence that an individual is not authorized to work in Canada;
• Update internal notices and materials to reflect the narrower collection authority applicable to citizenship markers and PHNs, as well as provide staff with training as to how to respond to questions regarding the statutory authority for the collection of personal information;
• If appropriate, update collection documents to specify the legal authority relied upon for any collection of citizenship or health information, including PHNs.

Citizenship markers and PHNs are only to be included on driver’s licences or ID cards that are newly issued or renewed. As a result, employers have an opportunity to use the gradual implementation of the new design to review their internal privacy management processes and ensure their ongoing statutory compliance.

McLennan Ross’ Privacy Team is prepared to assist employers with questions about how the aforementioned changes might affect existing collection practices, privacy notices, or employee relations concerns, as well as organizational compliance with the relevant privacy management legislation.