About a month ago, reports emerged of a data breach involving digital scans of more than 100 million driver’s licences. IDScan.net provides technology that can capture information and images from a driver’s licence, store them digitally, check for signs of fraud, compare the licence photo with a live photo or selfie, and verify details against supported databases.
Many people encounter ID-scanning technology in hospitality. Bars and entertainment venues use it to verify identity and help stop banned patrons at the door.
In Manitoba, some liquor stores take the process a step further. Customers wait in a locked vestibule while their identification is checked. Only a few people are allowed in at a time; the rest wait outside in −45 weather. Explaining this arrangement to someone who is not from Manitoba is always entertaining. Welcome to Manitoba, if you want alcohol bring your ID and dress for the weather.
IDScan.net also markets its technology to warehouses, shippers and transportation companies to verify driver identity and combat cargo theft. That raises an interesting question about the Air Canada gold heist: was the pickup driver’s ID checked?
Commercial drivers have reason to pay attention to this breach. Reported searches identified approximately 1.1 million Canadian licence records, although that figure is not a confirmed count of affected individuals. On September 21, 2026, the Privacy Commissioner of Canada announced an investigation into IDScan.net’s safeguards and its notifications to affected people.
Choosing to Share Information or Being Required To
If a nightclub requires an ID scan and you do not want to share your information, you can choose another venue or stay home.
ELDs are a different situation. For federally regulated commercial drivers required to maintain RODS, using a certified ELD is a legal requirement, subject to the prescribed exemptions. This is technology drivers must use to do their jobs.
The Canadian ELD Technical Standard includes protections for those drivers’ information. But how is the data protected, and who can access it?
From the Engine to the Dashboard
An ELD receives vehicle information from the engine’s electronic control module (ECM) and other sensors. It combines that information with the driver’s entries to create electronic records of duty status (RODS).
In a cloud-connected system, those records are transmitted to the ELD provider’s servers and stored. The carrier accesses each driver’s records through an online dashboard or similar portal to monitor hours of service, review events and retrieve reports.
An ELD is not intuitive it does not know why a truck moved. The ELD’s only job is to record a driver’s time using the information from the truck. Understanding what those records mean still requires someone who understands hours of service and ELD functionality.
Protection at Each Step
Security depends on the provider’s hardware, software and configuration. We should not assume that every connection is encrypted simply because the device is a certified ELD.
| Step | How data is protected |
| ECM → ELD hardware | The standard requires supported serial or CAN communication. That requirement alone does not establish that this connection is encrypted. |
| ELD hardware → phone or tablet, if used | Protection depends on the provider’s design, including pairing, authentication and encryption. |
| ELD → cloud | Encryption in transit can protect information moving to the provider’s servers. |
| Stored in the cloud | Safeguards can include encryption at rest, access restrictions and monitoring. |
| Cloud → carrier dashboard | HTTPS/TLS protects transmission to the browser. User permissions control access within the dashboard. |
| Downloaded report → carrier’s computer | Protection depends on the file and the carrier’s storage, access and sharing practices. Dashboard encryption does not automatically keep a downloaded PDF or CSV encrypted. |
Producing Records for an Inspector
When a driver is stopped roadside or at a highway inspection station, there are two related processes: showing records on the device display or a compliant printout (PDF RODS) and transferring the standardized electronic output file (CSV).
Technical Standard 4.9.1 Transfer of Electronic Files During Roadside Safety Inspections addresses electronic transfer. Email is mandatory; USB and Bluetooth are additional options where supported. Display and printout requirements are addressed separately in 4.8.1.
Under Federal HOS SOR/2005-313, subsection 98(2), the motor carrier must transmit electronic RODS to the inspector in the format and using a transfer method prescribed by the Technical Standard. If a driver is asked to provide RODS in a different way such as screenshots, do not pay that ticket and call me!
An electronic transfer gives the inspector records that can be examined beyond the device screen and retained as evidence. The inspection period includes the current day and the previous 14 days.
Who Has the Key?
Technical Standard 4.10.1.2 Wireless Data Transfer Through E-Mail requires encryption of the prescribed output file using a public key compliant with the Canadian PKI infrastructure.
PKI (public key infrastructure) is a digital lock-and-key system that protects information so only someone with the corresponding key can read it.
During implementation, provinces and territories were responsible for submitting enforcement officials’ email addresses and enrolling officials in the secure transfer process.
The Federal HOS regulations clearly identify who qualifies as an inspector.
SOR/2005-313, section 1:
inspector means
(a) a person designated under subsection 3(2); or
(b) a peace officer within the meaning of section 2 of the Criminal Code.
Directors section 3:
3 (1) The minister responsible for highway safety in a province may designate a person to exercise in the province the duties and functions of a director for the purposes of these Regulations.
(2) A director may designate inspectors for the purposes of these Regulations.
This ensures only the people “allowed” access to the data and the RODS have it.
Personal Use and Driver Privacy
Personal conveyance is the movement of a commercial motor vehicle (CMV) for personal use while off-duty. A driver may record time operating a CMV for personal conveyance as off-duty only when the driver is relieved from work and all responsibility for performing work by the motor carrier.
When a driver selects authorized personal use, the ELD records a start event. It continues monitoring cumulative personal-use distance, but 4.7.3 Privacy Preserving Provision for Use During Personal Uses of a CMV, restricts event recording to personal-use events, malfunctions and data diagnostics. When personal use ends, an end event is recorded.
Under 4.5.1.3(a)(b), those personal-use start and end events include location fields. The privacy protection is the absence of a regular intermediate location trail during the personal-use period, not the disappearance of every record associated with it. That happens because what the driver does during personal use is considered off duty and nobody’s business.
That distinction matters. So does the distinction between the ELD record and a separate fleet GPS system, which continues collecting location information.
Understanding the Data Matters
Protecting driver information and understanding ELD evidence go together.
Data breaches will remain a risk while stolen information has value. Drivers and carriers should use strong, unique passwords, enable multifactor authentication where available, limit account access and handle downloaded records carefully.
Providers and regulators also have responsibilities. Drivers cannot personally secure a provider’s cloud infrastructure or administer an enforcement PKI system.
Driver privacy matters enough to be addressed in the Technical Standard. The records matter enough to have prescribed formats and protected transfer methods. Understanding both should be a basic expectation of anyone assessing ELD compliance.
