The Manitoba Ombudsman has determined that Manitoba Conservation and Climate is unnecessarily asking for too much personal information when individuals are purchasing park passes and fishing licenses.
In its report, the ombudsman states that in April of 2020, the Manitoba government announced an online elicensing system for the sale of recreational outdoor licenses and permits, specifically hunting, angling and annual vehicle park passes. Prior to this system, these licenses and permits could be purchased in person from various outlets including some local stores and park entrances.
The ombudsman states that at that time, personal information that may have been collected from individuals depended on the specific licensee or permit being acquired. For example, personal information such as name, address, date of birth, and confirmation of a hunter education certificate was collected in the case of a hunting license purchase. No personal information was collected from individuals purchasing park vehicle permits.
According to the ombudsman, after the launch of the elicensing system, members of the public contacted their office to express concern over the personal information requested to set up a customer account.
One of the complaints was that the collection of personal information included driver's license number, passport number and personal health information number. There was also a concern that the vendor managing the elicensing system, RA Outdoors, is based in the United States and therefore personal information from Manitobans was being stored in that country. One final concern was that personal information might be shared with a third party.
The Manitoba Ombudsman says that in response to the concerns received, their office reviewed the information and noted that personal and personal health information including driver's license numbers, passport numbers, and personal health identification numbers was being collected for the purpose of setting up and signing into an elicensing customer account. The Manitoba Ombudsman says it launched an investigation into this matter in May of 2020.
The Manitoba Ombudsman states that its investigation found that the department's elicensing system contravenes both the Freedom of Information and Protection of Privacy Act (FIPPA) and the Personal Health Information Act (PHIA) in that it collects more personal information than is reasonably necessary.
It says the collection of personal information must be limited to only what is necessary for the purpose specific to either of the elicensing system's two-step process - either the creation of a customer account or the subsequent purchase of a license or permit. For example, the collection of personal information for a customer account must be limited to contact information, while the personal information collected for a hunting license must be limited to the specific information needed such as Hunter Education Certification Number, height, eye colour, and other identification details of the
individual wishing to hunt.
The Manitoba Ombudsman says the province should clearly determine what personal information is necessary for the purchase of each of the available permits and licenses to ensure that the collection of personal information is limited to only what is necessary and authorized under FIPPA.
It also recommends that the department immediately cease collecting personal health information for customer accounts as it contravenes PHIA. And, that all personal and personal health information that has already been collected that contravenes PHIA and FIPPA, be destroyed.
The Manitoba Ombudsman is suggesting that the department re-examine if the collection of birth dates for customer accounts is necessary. If it is not necessary for customer account set-up, the ombudsman recommends that the department cease collection of such personal information and destroy all collected to date.