Uber’s food delivery drivers are now required to take a photo of the driver’s licence or other ID of people who order alcohol but, Uber Eats has insisted, the pictures won’t be retained.
Uber Eats has advised Victorian customers ordering alcohol that from Thursday 29 October “delivery partners will need to take a photo of your ID before each delivery in order to verify your age”. The company doesn’t deliver alcohol in other states and territories.
The IDs accepted include any Australian driver’s licence, proof of age card, passport, Keypass card or Victorian learner’s permit, but the alert didn’t provide any information on how the photos would be used, and whether the data would be held securely and deleted when no longer required.
A spokeswoman for Uber Eats said the photos would not be held on the phones of delivery drivers or riders. The photo would feed into the Uber Eats driver’s app and would only record the customer’s date of birth and ID expiry date. Once that data was captured, the photo would be deleted, she said.
“Using this technology, the only data that is retained from the ID photo is the customer’s date of birth and expiry date of the document, both of which are encrypted, as per Uber’s privacy and information security program,” the spokeswoman said.
“The photo itself will be deleted from Uber’s systems once the encrypted information is extracted. No other personal information is gathered, only what is required to ensure the customer is of legal drinking age.”
The driver inputs what type of ID it is before it is scanned, and if it fails it reverts to the manual entry process.
Previously, Uber delivery drivers and riders were required to enter date-of-birth information manually into the app.
Users will be alerted to the new policy via a billboard at the top of the app and anyone without ID at the time of delivery will be given a refund. The driver will also still be paid for returning the alcohol, the spokeswoman said. The new policy was aimed at ensuring those under 18 weren’t getting alcohol delivered.
“We are proud to raise the bar for safety for alcohol delivery in Victoria by using industry-leading technology to help ensure alcohol is only delivered to people over the age of 18,” she said.
Although the policy is only being implemented in Victoria, it is the federal information commissioner who is responsible for ensuring the data collection complies with Australian privacy law.
A spokesman for the office of the Australian information commissioner said it would be making enquiries with Uber Eats about the new policy.
“We have not been consulted on this by Uber Eats and will make inquiries of them to ascertain the facts and circumstances,” he said.
“The Privacy Act 1988 requires that organisations only collect personal information that is reasonably necessary for their functions or activities. The Privacy Act also has important obligations to notify individuals of the purposes of collection, the consequences if personal information is not collected, and whether the collection is required or authorised by law (amongst other things).”
The Victorian privacy commissioner, Sven Bluemmel, told Guardian Australia best practice would be for businesses to collect as little information as needed, because the more that is collected, the higher the risk for inappropriate disclosure of personal information. Bluemmel questioned why there was a need to take photos of the licence at all.
“You wouldn’t need to take a photo of it and one of the big risks with all of this is identity theft,” he said. “All of these credentials like driver’s licences and so on … the more there are copies that are out there proliferating, the greater chance there is of all that being exploited for, among other things, identity theft.”
Identity theft support service IDcare has said people’s driver’s licences are the most sought-after form of ID for identity theft because it is the most common form of ID accepted in government and financial identity checking.
IDcare is currently providing support to around 186,000 people in New South Wales who had their licence and other identifying information exposed after 47 Service NSW email accounts were compromised earlier this year.