Manitobans gave more private info than necessary in online sale of park pass, licences: ombudsman

Manitobans are required to disclose too much personal information to buy a provincial park pass or hunting and fishing licence online, the province's ombudsman ruled.

The report argues it "is not reasonably necessary" that customers reveal their driver's licence number, passport number or personal health identification number to use the third-party online system, which Manitoba started using in 2020.

Divulging personal information for this purpose contravenes the Freedom of Information and Protection of Privacy Act and Personal Health Information Act, the ombudsman said.

Ann Cavoukian, Ontario's former privacy commissioner, said the level of information Manitobans are disclosing to visit a provincial park or cast a fishing line is "absurd." 

"Personal health information is being collected, which it shouldn't, and sensitive information like passport numbers and drivers licences just to get a hunting licence or whatever?" she said. "Far too excessive."

The ombudsman called on the province to immediately stop collecting people's personal health identification number and destroy all records, which the province says it did last year.

The report also recommends the province limit the collection of other forms of personal information, such as a driver's licence or passport number. This information is considered an "identifier" that's required when setting up a customer account.

The government said it is currently working to address that recommendation — but not fast enough, Cavoukian argued.

"That's the most damaging one," she said. "The enormous concern is when personal identifiers are used and collected in methods like this."

Cavoukian, who founded the "privacy by design" concept that calls on embedding privacy protections from the beginning to prevent future harms, said identity theft is becoming a growing threat that cannot be dismissed.

"It's really hard to completely restrict the use [of this information] to this and no one else gains access to it," she said. "They haven't even said if they're going to try and de-identify the data."

The ombudsman started its investigation in 2020 after receiving complaints from the public about the amount of information the Texas-based e-licensing vendor, RA Outdoors Ltd., operating as Aspira, wanted.

Individuals have been required to disclose personal information and personal health information to set up a customer account, the ombudsman said. Customers could sign into their account at any time to buy licences and permits. 

The ombudsman ruled that department sought too much information. FIPPA establishes that personal information may only be collected for a specific authorized purpose, and that collection must be limited to only as much personal information is reasonably necessary for the designated purpose.