Rules
Calgary identity verification under Alberta PIPA, a practical overview
Scam verification in Calgary runs on Alberta PIPA: what employers and energy contractors may request, how long to keep it, and where workers complain.
What to take away
- Scam verification in Calgary is a legal question before it is a technical one: Alberta PIPA limits what an employer or contractor can ask for, keep and share.
- Calgary employers may confirm identity and the right to work, but they cannot demand a SIN, a driver's licence copy or a birth certificate just because it is convenient.
- Energy-sector contractors face the same rules as staff, plus client-driven checks that often ask for more than Alberta PIPA allows.
- Consent and notice must come before collection, and the purpose must be one a reasonable person would accept.
- Document retention needs a written end date; keeping scans in a shared drive indefinitely is the most common failure.
- Workers who think a request is excessive or fake can complain to the Office of the Privacy Commissioner of Canada or Alberta's privacy office.
How Alberta PIPA shapes identity verification in Calgary
Alberta's Personal Information Protection Act applies to provincially regulated businesses in the province, while the Personal Information Protection and Electronic Documents Act covers federally regulated employers. Calgary employers in oil and gas services, engineering firms and construction fall under the provincial law. Banks, telecoms and airlines fall under the federal one.
The practical effect for identity verification is that a Calgary employer must have a reasonable purpose before asking for anything. Curiosity, convenience and "our client wants it" are not purposes. The employer must also tell the person what is collected, why, and who will see it.
Alberta PIPA also gives individuals the right to see the personal information an organization holds about them and to ask for corrections. That matters when a contractor's file contains a scanned passport from a job that ended years ago.
The Office of the Privacy Commissioner of Canada publishes an overview of privacy laws in Canada, which is the clearest starting point for employers unsure which regime applies.
What Calgary employers may legally request from a candidate
An employer can confirm that you are who you say you are and that you may legally work in Canada. That usually means one government photo ID, checked in person or over a live video call, and a Social Insurance Number only when payroll actually needs it.
The Office of the Privacy Commissioner of Canada advises that a SIN is not a general identifier and should not be collected at the application stage or used as an employee number.
Its guidance on SINs and driver's licences explains why a driver's licence is also not a universal ID, and why copying it creates a record that has to be protected.
Here is a workable sequence for a Calgary hiring desk:
- Ask for the legal name and confirm it against one photo ID at the interview or onboarding stage.
- Collect the SIN only after a written offer, and only for payroll and tax reporting.
- Record the verification result, not the document image, unless an image is genuinely required.
- Tell the candidate in writing what was checked and what was kept.
- Give a contact for questions about the file.
A short checklist keeps the process honest:
- Written notice given before any document is collected
- One photo ID accepted, not a folder of documents
- SIN collected only for payroll
- No copies stored unless a real need exists
- Retention period stated in the privacy policy
- Access and correction request route published
Energy-sector contractors: documents, storage and retention
Contractors working on Calgary energy sites often face layered checks: the hiring company, the prime contractor, and the site operator each want something. Client requirements can push requests past what Alberta PIPA permits.
A site operator may need to confirm safety training, certifications and the right to work. That is legitimate. It does not follow that the operator may keep a passport scan or a driver's licence image for the life of the project.
Document retention is where most Calgary energy firms get into trouble. Scans sit in project folders, shared drives and email inboxes long after the contract ends. Each copy is a separate risk, and none of them has an owner.
A defensible retention rule ties the record to a purpose. Keep the verification result while the contract runs, plus the period your insurer or a regulator requires. Then destroy it. Alberta PIPA expects destruction that prevents reconstruction, not deletion from one folder while a backup lives on.
Contractors should ask two questions before handing anything over: what will be kept, and when will it be destroyed. A company that cannot answer both is not ready to hold the document.
The Canadian Centre for Occupational Health and Safety sets out the wider rights and responsibilities that shape workplace privacy expectations in Canada.
Consent and notice requirements under Alberta PIPA
Alberta PIPA works on consent, and consent has to mean something. It must be given for a stated purpose, at the time of collection, by a person who understands what they are agreeing to.
Notice comes first. The employer tells the candidate what is collected, why, how it will be used, who it may be disclosed to, and how to ask questions. Consent follows. A signature on a dense onboarding form rarely meets that standard on its own.
Consent can be withdrawn, within limits. If payroll needs a SIN to issue a paycheque, withdrawing consent may end the employment relationship, but the employer should say so plainly rather than imply the choice is free.
The Office of the Privacy Commissioner of Canada's guidance for employers and employees explains the limits on workplace collection in plain terms and applies to the federal side of the same problem.
For organizations writing this down, our guide to background checks is a faster route than drafting from scratch, provided the retention and access sections are filled in with real Calgary practice.
Storing and destroying identity documents safely
Store identity records separately from ordinary HR files, with access limited to the people who need them. A shared payroll inbox is not a controlled store.
Encrypt scans at rest and in transit. Log who opened each file. If a contractor's licence image is accessed by someone with no role in verification, that access should be visible.
Set a destruction schedule and follow it. Shred paper, and for digital records use a method that removes the file from backups and sync folders, not just the main directory.
Train the people who handle documents. Most breaches in small Calgary firms come from an email sent to the wrong address or a file left in a personal cloud account, not from a sophisticated attack.
If a breach does occur, assess whether there is a real risk of significant harm and report it where the law requires. The Office of the Privacy Commissioner of Canada's material on identities covers identity theft and the steps that follow a compromised document.
When a verification request looks like a scam
A genuine employer check and a scam can look alike at first glance. The difference is usually in the channel, the timing and the appetite for documents.
Warning signs worth acting on:
- A request for a SIN, banking details or a passport scan before any interview or written offer
- Contact only through a messaging app, with no verifiable company phone number or address
- Pressure to respond within hours, or a threat that the role will be withdrawn
- A job posting that copies text from a real Calgary company's careers page
- Payment requested for training, equipment or a background check
Scam verification is mostly about slowing down. Look up the company independently, call a number you found yourself, and ask the recruiter to confirm the request in writing from a company address.
Workers can also check whether a request matches what the employer said it would collect. A sudden demand for documents that were never mentioned in the notice is a reason to pause.
Our roundup of the best marketplace scam tools 2027 walks through the tells that separate a real request from an imitation, and the best phishing scams tools 2027 overview covers what goes wrong when documents are over-collected.
Complaint routes for Calgary workers
If a Calgary employer or contractor collects more than Alberta PIPA allows, the first step is a written request to the organization: what do you hold, why, and when will it be destroyed. Many disputes end there.
If that fails, a complaint can go to the Office of the Privacy Commissioner of Canada for federally regulated employers, or to the Alberta privacy office for provincially regulated ones. The Office of the Privacy Commissioner of Canada's page on privacy laws in Canada sets out which law applies.
Suspected fraud, including a fake recruiter asking for documents, can be reported to the Canadian Anti-Fraud Centre. Keep the messages, the posting and any account details.
For a dispute about what an employer may lawfully ask, our notes on the best romance scams tools 2027 cover the boundaries that come up most often.
Common questions
Can a Calgary employer ask for my SIN before hiring me? No. A SIN is for payroll and tax reporting, so it should be collected after a written offer. The Office of the Privacy Commissioner of Canada treats it as a sensitive identifier, not a general employee number.
Does Alberta PIPA apply to a contractor working on an energy site? Yes, if the organization is provincially regulated. Client and site-operator requirements do not override Alberta PIPA, and a request that exceeds the law is still excessive even when a contract asks for it.
How long can a Calgary employer keep a copy of my driver's licence? Only as long as a stated purpose requires. In practice, keep the verification result rather than the image, and destroy the record once the contract or employment period and any legal retention duty end.
What should I do if a recruiter asks for documents by text message? Stop and verify the company through a number or address you found independently. Do not send a SIN, passport scan or banking details through a messaging app, and report the contact to the Canadian Anti-Fraud Centre.
Can I see the identity documents an employer holds about me? Yes. Alberta PIPA gives you a right of access and a right to request corrections. Ask in writing, and the organization must respond within the time set by the law.
Where do I complain if a Calgary employer ignores my request? Start with the organization's privacy contact. If that fails, complain to the Alberta privacy office or, for federally regulated employers, the Office of the Privacy Commissioner of Canada. Keep copies of every message.
