Key takeaways
- On September 21, 2026, Privacy Commissioner Philippe Dufresne opened an investigation into the IDScan.net breach, where an unauthorized third party stole digital scans of driver’s licences and other government-issued ID. The probe will test the company’s security safeguards and the adequacy of its breach notifications under PIPEDA.
- ID scans are among the worst records to lose: a driver’s licence number cannot be cancelled like a credit card, and the fraud it enables is slow-burning and hard to attribute, which is exactly why the OPC flags notification adequacy as a separate line of inquiry.
- If your business outsources ID verification, the investigation landed on your risk register too. The OPC published draft guidance on September 10 on assessing third-party service providers, and the message is consistent: you remain responsible for personal information a vendor holds on your behalf, so your vendor file needs due diligence, contract terms, and a tested breach notification chain.
On September 21, 2026, the Office of the Privacy Commissioner of Canada announced that Commissioner Philippe Dufresne has opened an investigation into a data breach at IDScan.net. An unauthorized third party gained access to the company database and stole personal information, including digital scans of driver’s licences and other government-issued identification.
IDScan.net’s technology is used by hospitality and nightlife establishments, among others, to verify customers’ government-issued ID at the door. Think about the scale of that deployment: every bar, club, and lounge scanning licences at entry feeds one vendor database, and that database just became a breach headline. IDScan.net issued a public advisory earlier this month; the OPC says it has been actively engaging with the company since and will continue to.
The announcement itself is short. The two lines of inquiry inside it are what matter.
What the OPC is actually examining
The investigation will examine two things: the security safeguards IDScan.net had in place at the time of the breach, and the adequacy of its notifications to affected individuals. Both feed a single question: compliance with PIPEDA, Canada’s federal private-sector privacy law.
Safeguards means the OPC will reconstruct what protected the database when the attacker arrived. Patching, access controls, encryption at rest, monitoring, and segmentation are all in scope in practice, even though the announcement names none of them. The question is not whether the company had controls after the incident; it is what was live when the records were taken.
Notification adequacy is the subtler line. It asks whether affected people were told, what they were told, when they were told it, and whether the notice gave them something useful to do. The OPC treats notification as its own compliance obligation, not as a courtesy. A public advisory exists, and the regulator still decided to probe the notices. That gap between “we said something” and “the notice was adequate” is where many organizations misjudge their position.
As the OPC notes, this is an active investigation, so expect no further details from Gatineau for now.
Why ID scans are the worst record to lose
Not all breached data ages equally. Compare the record types:
| Record type | Can be reissued | Fraud latency | Typical mitigations |
|---|---|---|---|
| Credit card number | Yes, within days | Fast, visible | Card replacement, fraud alerts |
| Password | Yes, by the user | Medium | Credential reset, MFA |
| Driver’s licence scan | Effectively no | Slow, hard to attribute | Limited: flag files, monitor credit |
A driver’s licence number in Canada is stable for years and difficult to replace. The image shows your photo, address, date of birth, and signature. It is the master key for synthetic identity fraud: open accounts, defeat knowledge-based verification, and impersonate the person whose face is on the card. Victims often discover the misuse months later, through a collections notice or a denied application, by which point attribution is gone.
That is the context behind the OPC’s focus on notification adequacy. When the records are this durable, a thin advisory that says “we take your privacy seriously” is not adequate. People need to know what was taken, when it happened, what the company is doing, and what concrete steps they can take, such as monitoring for identity fraud and knowing which agencies to contact. Organizations that template their breach notices for the easy case discover too late that the hard case is the one the regulator reads closely.
The vendor behind your vendor
Here is the part that lands on every privacy team’s desk, not just IDScan.net’s. If your bars, venues, or retail locations scan IDs, those scans live in a third party’s database. Your customers handed their identity documents to you, and you routed them to a vendor. Under PIPEDA, you remain responsible for personal information under your control, including information a third party holds or processes on your behalf.
This timing is not a coincidence. On September 10, 2026, the OPC published draft guidance on assessing the privacy practices of third-party service providers, open for comment until December 4, 2026. The guidance walks through identifying privacy risks, deciding whether to engage a vendor, shaping contract terms, and demonstrating accountability. The Commissioner’s framing, “investing in privacy protection can be a competitive advantage,” reads less like soft language now and more like advance warning.
The pattern across the two September announcements is coherent: tighten the vendor file before the breach, and expect the notification chain to be audited after it. The OPC is looking at safeguards and notices in the same investigation. Your program should treat them as one system.
What privacy teams should do this week
- Inventory ID-verification vendors. List every tool that scans, photographs, or stores government-issued ID, at doors, desks, and onboarding flows. Record where the images are stored, how long they are kept, and who can access them.
- Read your breach notification chain in the contract. Confirm the vendor must notify you before it notifies anyone else, with a defined clock, and that you receive enough detail to notify affected individuals yourself. If the contract is silent, that is the finding.
- Pressure-test a notification draft for ID-document breaches. Draft the notice you would send if scans were stolen, not passwords. Include what was taken, the time window, what you are doing, and concrete steps for the person: credit monitoring options, how to flag identity fraud with the issuing authority, and where to get help. A plan that only covers credentials is not a plan.
- Retention is the cheapest control you have. If the vendor stores ID images after verification succeeds, ask why and for how long. Data you never kept cannot be stolen. Verification can be a yes-or-no event; the image archive is a separate design choice.
- Track the draft guidance. The OPC’s third-party provider guidance is in consultation until December 4, 2026. Use the comment window to sanity-check your vendor assessment template against the regulator’s expected structure.
Actionable takeaway: Pull your ID-verification vendor list this week and answer three questions for each: where the scans are stored, who notifies whom within what clock, and whether your draft notice is specific enough for identity documents that cannot be reissued. If any answer is “we are not sure,” that is the gap the OPC just decided to investigate somewhere else.