Can a business scan or copy my driver licence or passport?

The Privacy Commissioner’s view

The Commissioner has said for years that simply looking at ID is usually enough. In one case it accepted that a business needed to verify identity, but found that viewing the ID met that need, and that recording the licence number or photocopying the licence wasn’t necessary. It has also considered a case about a bar that scanned and kept copies of patrons’ driver licences.

The reasons are practical. Identity documents can’t easily be changed if they leak, unlike a credit card. Every stored copy is a risk, as the large data breaches of recent years have shown.

When a copy may be justified

• Anti-money laundering checks. Banks, lawyers, real estate agents, accountants and others covered by anti-money laundering law must verify identity and keep records for set periods.
• Credit and tenancy checks. A landlord may need ID details to run a credit or criminal record check once you’re negotiating an offer.
• Specific legal requirements in other sectors.

Even then, the business should keep only what it needs, protect it, delete it when the retention period ends, and consider obscuring numbers it doesn’t need.

What a business should tell you

The Commissioner expects front-line staff to tell you why ID is needed, whether it will be copied, and how long a copy will be kept. If they can’t answer, that’s a sign they haven’t thought about it.

What you can do

• Ask: “Can you just look at it rather than copy it?” Many businesses will agree.
• Ask why, and for how long, if they insist on copying.
• Offer an alternative, such as showing ID that has fewer details, if they only need to confirm your age.
• Ask them to delete it after the check is done.
• If your ID was exposed in a breach, ask the business whether it will pay for a replacement, and consider a credit file suppression.

Facial recognition and ID scanners

If a venue or shop uses technology that analyses your face or matches you against a list, the Biometric Processing Privacy Code applies, with stricter rules. See our biometrics guide.