What PIPEDA means for ID verification

If your business collects a photo of someone's driver's licence or passport, you are collecting some of the most sensitive personal information there is: a full legal name, a date of birth, a document number, a photo, sometimes an address. In Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organizations handle that information. This post walks through what PIPEDA's ten fair information principles actually mean for a business running identity verification, and where they show up in a product like ShieldID.

This is not legal advice. PIPEDA applies differently depending on your sector, your province and what you do with the data; Quebec has its own, stricter regime layered on top. Talk to your own counsel about your specific obligations. What follows is a plain-language map of the principles themselves.

The ten principles, in practice

PIPEDA is built around ten principles, drawn from the Canadian Standards Association's model privacy code and written into Schedule 1 of the Act. They are not ten separate boxes to tick; they describe a single lifecycle for personal information, from the moment you decide you need it to the moment you get rid of it.

• Accountability: one person or role at your organization is responsible for privacy compliance, and that responsibility does not disappear when you hand ID images to a third-party verification vendor. You remain accountable for what happens to the data, which is why your contract with that vendor matters.
• Identifying purposes: you say, before you collect it, why you need the ID. “We verify identity to reduce fraud on rental applications” is a purpose. “We might need it later” is not.
• Consent: the person understands what is being collected and why, and agrees to it, before the verification happens. Consent for a specific purpose does not cover a different, later purpose.
• Limiting collection: collect only what the stated purpose requires. If you only need to confirm someone is over 18 and lives in Ontario, you do not need their full document number on file indefinitely.
• Limiting use, disclosure and retention: use the data only for the purpose you named, do not hand it to someone else without consent or legal authority, and keep it only as long as the purpose requires — then get rid of it.
• Accuracy: personal information should be as accurate, complete and current as the purpose requires. This is one reason per-field verdicts matter more than a single pass/fail score: you can see exactly which piece of data the system is and is not confident about.
• Safeguards: protect the data with security appropriate to its sensitivity — encryption, access controls, and limits on who can look at it and when.
• Openness: make your privacy practices available in plain language, not buried in a EULA nobody reads.
• Individual access: on request, tell someone what personal information you hold about them and how it has been used, and correct it if it's wrong.
• Challenging compliance: give people a way to complain, and have a process for investigating and responding to that complaint.

What this looks like inside ShieldID

A few of these principles map directly onto specific things a verification platform should be able to point to, not just promise. Limiting collection and retention is the clearest one: ShieldID extracts the fields a decision needs — name, date of birth, document number, address, the photo for face matching — and purges the ID images automatically on a short timer, seven days by default. The verification record (that a check happened, and its outcome) outlives the images; the images themselves do not sit around indefinitely.

Safeguards show up as encryption: date of birth is stored encrypted, not in plain text, and ID images are encrypted at rest with AES-256-GCM. Accountability and openness show up in the Activity Ledger — Trust Ledger's append-only record, enforced by the database. Identity verification itself contributes exactly two entries, verified or failed; broader ledger entries for a standalone ShieldID API account are coming soon. Entries can be added, never edited or deleted, which gives a privacy officer or a person disputing a decision something concrete to point to, rather than a vendor's word.

It is worth being precise about what ShieldID does not claim. We do not hold a PIPEDA certification, because no such certification exists for any vendor to hold — PIPEDA is a law, not a standards body with a badge. The honest phrasing is that ShieldID is designed to align with PIPEDA: Canadian hosting, minimum collection, an automatic purge timer and an auditable record are controls, not a compliance guarantee. Whether your organization's overall use of the product is PIPEDA-compliant is a determination for your organization and, where needed, your own counsel — the tool cannot make that determination for you.

Quebec's Law 25

If you operate in Quebec, PIPEDA is not the only law in play. Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) sets its own, generally stricter requirements for private-sector organizations, including rules around consent, breach notification, privacy impact assessments for some projects, and biometric data specifically. Face matching and liveness detection process biometric information, which is exactly the category Law 25 pays closest attention to. If your applicants are in Quebec, treat PIPEDA as the floor, not the ceiling, and get Quebec-specific advice before you rely on federal rules alone.

What PIPEDA does not require

It's also useful to know what the law does not specify. PIPEDA does not set a fixed retention period in days — it says “as long as necessary,” and leaves the number up to you and your purpose. It does not mandate a specific encryption algorithm or a specific hosting country; residency is one reasonable safeguard among several, not a legal requirement in itself for most organizations. And it does not require a vendor to hold a particular security certification. None of that makes those choices unimportant — they are just controls an organization adopts to meet the principles, not boxes PIPEDA itself checks for you.

The short version: know what you're collecting and why, collect the minimum, protect it, keep it only as long as you need it, and be able to show your work. A verification platform can make each of those easier — a short retention timer, encryption by default, a record you can search — but the obligation sits with the organization doing the collecting, not the tool it uses.