Privacy Impact Assessment and Update

Enhanced Driver's Licence and Enhanced Identification Card

About the Western Hemisphere Travel Initiative

The Western Hemisphere Travel Initiative (WHTI) is a U.S. law that requires all travellers, including U.S. and Canadian citizens, to present a valid passport or another approved secure document when entering the United States from within the western hemisphere.

About the enhanced driver's licence

In response to the U.S. WHTI document requirements, the Government of Canada proposed the development and implementation of provincial and territorial enhanced driver's licence (EDL) programs1 and mandated the Canada Border Services Agency (CBSA) to be the lead for this. Under the U.S. WHTI, an EDL is an acceptable document that Canadian citizens can present when entering the United States by land and water only. The EDL contains a machine-readable zone and a radio frequency identification (RFID) chip, which allow EDLs to be read at the border using traditional and new technology methods. The inclusion of RFID technology in EDLs is a U.S. requirement that helps facilitate and expedite traveller processing at the border.

The Province of British Columbia (B.C.), in partnership with the Government of Canada, launched Phase 1 of Canada's first EDL program in January 2008 as a pilot program with full implementation in May 2009. Quebec, Manitoba and Ontario all implemented EDL programs in the spring of 2009.

Protecting personal privacy

As part of Phase 1 of B.C.'s EDL program, a privacy impact assessment (PIA) was undertaken to address privacy issues and submitted to the Office of the Privacy Commissioner of Canada (OPC) in January 2008. The PIA was limited to the assessment of Phase 1 of B.C.'s EDL program, a phase in which only 521 EDL cards were issued.

Since January 2008, the EDL program has matured and changed. To reflect these changes and address the concerns raised by the OPC following its review of the January 2008 PIA, the CBSA submitted a PIA update to the OPC in December 2008. The CBSA will submit PIA updates periodically to the OPC when there are major changes to the EDL program or when new developments occur.

Safeguards to personal information

Since January 2008, the CBSA has taken steps to mitigate the privacy risks identified by the OPC, including the implementation of the following key safeguards:

• All EDL holder information will be stored in a database developed and maintained by the CBSA and housed in Canada. U.S. Customs and Border Protection (CBP) will not have access to the CBSA's database. U.S. CBP will send a request for EDL information to the CBSA only when an EDL holder seeks entry into the United States at a land or water border crossing. U.S. CBP's requests will be validated and processed by the CBSA, and the necessary information will be transmitted electronically via a secure mechanism. This information is very similar to what is available on the face of the EDL or in a passport;
• The inclusion of RFID technology in the EDL is a U.S. requirement. Strategies have been put in place to ensure the protection of EDL information. The RFID chip contains no personal information. It contains two sets of unique numbers: a tag identification number embedded by the manufacturer to prevent cloning, and an encoded RFID tag number containing a series of 1s and 0s used to retrieve information from the secure EDL database housed in Canada. The chip is passive, does not transmit information and can only be read from a short distance. Participating provinces and territories will be required to issue EDLs with a protective sleeve to prevent fraudulent activities. The CBSA has been advised that testing has proven that even at maximum power in the RFID reader, the cards were not readable while in the sleeve. The CBSA has no plans to add personal information to the RFID chip;
• The CBSA is working closely with participating provinces and territories to ensure that EDL applicants are fully informed on and understand this voluntary program and that their consent is meaningful. Participating provinces and territories, in collaboration with the CBSA, are developing a complete Participant Guide, which will address the collection, use, disclosure, retention and storage of EDL information, as well as provide other information required in order for applicants to give their meaningful and informed consent to participate;
• U.S. CBP creates a border crossing record each time individuals seek to enter the United States, whether they are using a passport, an EDL or another approved document. U.S. CBP has procedures in place to allow individuals to access and amend their records, captured in the Border Crossing Information system. Participating provinces and territories have also confirmed that they have legislation or mechanisms in place to allow EDL holders to review or check the accuracy of their information held by the province or territory. Furthermore, the CBSA has registered its EDL database with Info Source in order to facilitate EDL holders' access to their own information; and
• The CBSA will continue to work with participating provinces and territories and other stakeholders to ensure that Canadian privacy requirements are met during the implementation of EDL programs.

1. Please note that some participating provinces and territories will also offer an enhanced identification card (EIC) for individuals who do not drive. References to EDLs in this summary include EICs.