Manitobans gave more private info than necessary in online sale of park pass, licences: ombudsman

Manitobansare required to disclosetoo much personal informationto buy aprovincial park pass or hunting and fishing licence online, the province's ombudsman ruled.

The report arguesit "isnot reasonably necessary" that customersreveal their driver's licence number, passport number or personal health identification number to use thethird-party online system, which Manitoba started using in2020.

Divulging personal information for this purposecontravenes the Freedom of Information and Protection of Privacy ActandPersonal Health Information Act, the ombudsman said.

Ann Cavoukian, Ontario's former privacy commissioner, said the levelofinformation Manitobansare disclosing to visit a provincial park or cast a fishing line is "absurd."

"Personal health information is being collected, which it shouldn't, and sensitive information like passport numbers and drivers licences just to get a hunting licence or whatever?" she said. "Far too excessive."

The ombudsman called on the province to immediately stop collectingpeople's personal health identification number and destroy all records, which the province says itdid last year.

The report also recommends theprovincelimit the collection of other forms of personal information, such as a driver's licence or passport number. This information is considered an "identifier" that's required when setting up a customer account.

The government said it is currently working to address that recommendation butnot fast enough, Cavoukianargued.

"That's the most damaging one," she said. "The enormous concern is whenpersonal identifiers are used and collected in methods like this."

Cavoukian, who founded the "privacy by design" concept that calls on embedding privacy protections from the beginning to prevent future harms,said identity theft is becoming agrowing threat that cannot be dismissed.

"It's really hard to completely restrict the use [of this information]to this and noone elsegains access to it," she said. "They haven't even said if they're going to try and de-identify the data."

Ombudsman investigated complaints

The ombudsman started its investigation in 2020 after receiving complaints from the public about the amount of information the Texas-based e-licensing vendor,RA Outdoors Ltd., operating asAspira, wanted.

Individuals have beenrequired to disclose personal information and personal health informationto set up a customer account, the ombudsman said. Customerscould sign into their account at any time to buylicences and permits.

The ombudsman ruled that departmentsoughttoo much information. FIPPA establishes that personal information may only be collected for a specific authorized purpose, and that collection must be limited to only as much personal information is reasonably necessary for the designated purpose.

The report explained some products like a provincial park vehicle permit only requireda vehicle licence plateunder the previous paper-only booking system, but nowthe online vendor demands more information just to create a customer account.

The ombudsman suggests the e-licensing system could insteadoffer individuals the option of being a "guest" rather than creatingan entire customer account.

"If this option were offered, the e-licensing system would only need to collect personal information specific to the licence or permit being purchased, and the transaction being made," the document states.

The ombudsman's report was dated Mar. 31, 2023, but wasonly published on the ombudsman's websitelast week.

Online service more expensive

The privacy concerns are the latest blow the Progressive Conservative government is facing over its e-licensing agreement with Aspira. In 2020, the province moved from an exclusively paper-onlysystem into a more expensiveonline process. Aspira tacked on a $4.50 administration fee with each transaction, which nearly doubles the price of a day pass that once cost $5.

The province is also paying the company more than $1 million in e-licensing fees, according to documents obtained by the NDP.

NDP Leader Wab Kinewsaid it's inexcusable that Manitobans' personal information was put at greater risk. It adds credence to his party's argumentthe government should look to an online vendor within the province instead, he said.

"Why doManitobanshave to enter into a business relationship with an American company to go outdoors and enjoy Manitoba?

"I think this privacy issue is just a red flag for what has been a bad deal for Manitobans."

A spokesperson says the Manitoba government ownsand controls all data collected through the online platform. The data is stored in Canada and is not shared or sold to any third party.

Greg Nesbitt, the minister of natural resources and northern development, said the government is taking the privacy of Manitobans seriously byresponding to the various recommendations.

Province will honour contract: Nesbitt

"I think that we should only be collecting the information we need to get people's licences. I respect the work of the ombudsman on this."

He said Manitoba entered into the e-licensing contract with Aspirathrough an opentendering process. Though it's a U.S. company, Aspira has lots of connections with Canada, including providing e-licensing services in Alberta and Saskatchewan and employing support staff in various provinces, such as Manitoba.

"That being said, weintend to honour the contract and when the new [request for proposals]comes out, we'll certainly look at anyone who wants to bid on this contract," Nesbitt said.

Manitoba's contract with Aspira expires in March 2025.Aspira did not respond to a request for comment.