The technology behind Ontario's new enhanced driver's licences will allow people to secretly track other people's activities and movements unless privacy protection is added, warns the province's privacy commissioner.

Radio Frequency Identification

Radio Frequency Identification, or RFID, is a generic term for technology that uses radio waves to identify people or objects. Information ranging from a simple serial number to more complex data is carried on a microchip with an antenna that can be as small as a grain of sand.

A RFID system consists of a tag — made up of a microchip with an antenna — a reader and a database. The reader sends out electromagnetic waves.

When these waves hit a passive RFID tag antenna, it draws power from them and uses it to power the microchip's circuits. The chip then alters the waves it sends back, which the reader converts into digital data.

Typical "passive" tags — that is, tags that require signals from an outside reader to power the chip — have a limited range, with a typical range of just a metre and a maximum range of around 12 metres. Larger "active" tags with their own battery power can be read from distances of 100 metres or more.

"The radio frequency identity (RFID) tag that will be embedded into the card can be read not only by authorized readers, but just as easily by unauthorized readers," Ann Cavoukian said in a statement accompanying the release of her 2008 annual report Wednesday.

Cavoukian called on Ontario's minister of transportation to include an on-off switch that will provide better privacy protection with the new licences, which are scheduled to start rolling out June 1.

On that date, the U.S. will start requiring a passport for all Canadian visitors entering the country at land crossings without an enhanced driver's licence.

According to the Ontario government, the RFID microchip inside the licence contains only a unique identification number and no other information. The licence will come with a sleeve that will protect it from being read.

However, Cavoukian suggested that because people are often required to produce their licences in many contexts away from the border, such as while banking and shopping, most drivers will abandon the use of the protective sleeve.

She favours including a feature that will prevent the RFID switch from being read unless it is turned on.

Cavoukian made recommendations about two other issues in her report. She said:

  • Fees charged to patients for access to their own health records should be regulated. The privacy commissioner's office said it has received a number of complaints about the fees currently charged.
  • All publicly funded Ontario universities, including affiliated universities, should be covered under the province's Freedom of Information and Protection of Privacy Act. The recommendation came after the University of Toronto tried to block access to information about its affiliate, Victoria University, because it is not explicitly and separately named in the act.