Scans of driver’s licences and other government ID belonging to millions of North Americans sat inside IDScan.net’s cloud network. Canada’s privacy commissioner now wants to know how they got out.
The Office of the Privacy Commissioner announced the probe on Monday, days after confirming it was engaged with the company. Commissioner Philippe Dufresne will examine the security safeguards IDScan.net had in place when intruders reached its cloud, and whether the vendor notified victims adequately, to determine compliance with the Personal Information Protection and Electronic Documents Act.
Under PIPEDA, organizations must report breaches that create a real risk of significant harm, including identity theft, financial loss or damage to credit records.
IDScan.net sells identity verification software to bars, casinos, hospitality venues and car rental counters. Its September 4 notice said an unauthorized third party may have accessed or copied customer information stored in its cloud accounts. Reports have put the exposed trove at roughly 153 million licence records from the United States and Canada, and the FBI has said it is investigating the theft.
The commissioner’s office said it would keep working with the company “to ensure that the organization is taking the necessary steps to address the incident and mitigate any risks to Canadians.”
It is the first time a Canadian agency has confirmed an active investigation into the breach. The RCMP said last week it was monitoring the situation and coordinating with domestic and international law enforcement partners.
Canada’s regime lets the commissioner compel documents, publish findings and, in some cases, take a matter to Federal Court. The probe now tests how far a federal regulator can reach into an American vendor holding government-issued ID for rental firms and nightlife venues on both sides of the border.
