Monthly Archives: July 2026

Spotlight on Patronscan

1. What is the mission and vision of Patronscan?

We create safe environments and trustworthy relationships through identity verification.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Organizations increasingly need to know that an individual is who they claim to be, that the credential being presented is authentic, and that the person is authorized or eligible to complete a particular action.

This is already critical in sectors such as hospitality, gaming, retail, financial services, transportation, property management, and access control. It will become even more important as services become increasingly digital, fraud becomes more sophisticated, and interactions move between online and physical environments.

Effective identity verification reduces fraud, supports regulatory compliance, protects vulnerable and age-restricted markets, and creates confidence between organizations and the people they serve. The challenge is to deliver that trust without creating unnecessary friction or collecting more personal information than the situation requires.

Digital trust is therefore not simply a technology issue. It is a foundation for safe participation in both the digital and physical economy.

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Trusted identity systems can make it easier and safer for people to access services, complete transactions, enter controlled environments, and demonstrate eligibility. For organizations, they can reduce fraud, automate manual processes, strengthen compliance, improve community safety, and make services more accessible and efficient.

However, this transformation must be approached responsibly. Identity verification can create new risks when systems are difficult to understand, or do not provide meaningful privacy protections and accountability.

Patronscan addresses these challenges by designing identity verification for practical, high-volume operating environments. Our platform combines document authentication, age verification, fraud detection, access-control workflows, and configurable data-management practices. We focus on helping organizations make a specific decision such as whether an ID is authentic, whether an individual meets an age requirement, or whether access should be granted, while respecting applicable privacy requirements.

We also recognize that trust cannot be created through technology alone. It requires transparency, appropriate governance, strong security, clear retention practices, and continued collaboration among technology providers, governments, regulators, businesses, and the public.

4. What role does Canada have to play as a leader in this space?

Canada has strong institutions, respected privacy and security expertise, a diverse population, and a history of collaboration between the public and private sectors. These strengths can help Canada develop approaches that balance security, privacy, accessibility, consumer choice, and commercial innovation.

Canadian leadership should include developing clear and practical trust frameworks, encouraging standards-based, supporting responsible innovation, and creating greater consistency across jurisdictions. Canada can demonstrate that strong privacy protection and effective identity verification are not competing objective, they are both essential components of a trusted economy.

By establishing trusted models domestically and aligning them with international standards, Canada can help Canadian organizations compete globally while giving individuals greater confidence in how their identities are verified and protected.

5. Why did your organization join the DIACC?

Patronscan joined the DIACC because the future of digital trust and the technology that enables it cannot be shaped by any one company, sector, or level of government.

We wanted to participate in the broader Canadian conversation about identity verification, privacy, security, and responsible innovation. DIACC brings together organizations with different experiences and perspectives, creating an important forum for developing shared frameworks and practical solutions.

As a Canadian company that has been verifying identity in high-volume, real-world environments for more than two decades, Patronscan can contribute practical insight into how trust frameworks operate at the point of service. We also benefit from learning from other DIACC members and participating in the development of approaches that can strengthen Canada’s ecosystem.

Our membership reflects our commitment to collaboration, accountability, and the continued advancement of trusted identity services in Canada and internationally.

6. What else should we know about your organization?

Patronscan is a Canadian-founded identity verification company with more than 20 years of experience helping organizations verify government-issued identification and make safer, more informed decisions.

Our technology is used across Canada and internationally in industries including hospitality, casinos, retail, events, municipalities, automotive, financial services, transportation, and controlled-access environments. Our platform supports forensic document authentication, age verification, fraud prevention, access control, operational reporting, and connected safety workflows.

What began as a solution for detecting fake identification has evolved into a broader identity verification platform supporting organizations wherever trust, eligibility, safety, and access intersect.

We are proud to be a Canadian technology company operating globally, and we believe our experience in demanding frontline environments gives us a valuable perspective on the future of digital trust. Identity verification must be accurate and secure, but it must also be fast, understandable, operationally practical, and worthy of the public’s confidence.

Spotlight on Identita

1. What is the mission and vision of Identita?

Mission: To make identity protection seamless, intelligent, and human through secure biometric, credential, and location technologies.

Vision: To set the global standard for trusted identity in a connected world, where security is effortless, precise, and built into everyday experiences.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Access to essential services depends on identity. Identity verification reduces fraud, supports compliance, and enables cross-border commerce. The rise of AI deepfakes raises risks for KYC and remote verification

3. What role does Canada have to play as a leader in this space?

Digital trust and identity verification are becoming essential to the Canadian and global economy. As more services, transactions, and access decisions move online, organizations need reliable ways to confirm identity, reduce fraud, and protect sensitive information without creating unnecessary friction for legitimate end users. In Canada, this will support more secure banking, healthcare, government services, education, and workplace access. Globally, it will help enable safer cross-border trade, faster digital onboarding, and broader participation in the digital economy.

This shift brings real challenges. Identity systems must be strong enough to defend against increasingly sophisticated threats, while still being simple to use, respectful of privacy, and compatible with existing infrastructure. If security creates too much friction, adoption slows. If convenience comes at the expense of trust, the risk to organizations and users increases.

Identita addresses this challenge by building secure identity solutions that combine advanced biometrics, credential technologies, and real-time location intelligence in practical, familiar form factors. Our approach is to increase assurance while reducing complexity for the end user. By integrating fingerprint and ECG-based authentication with smart card platforms and RTLS technologies such as BLE, UWB, and GNSS, we help organizations verify identity with greater confidence and better context. This supports safer access, more trusted transactions, and stronger accountability across sectors including government, finance, healthcare, education, defence, gaming, automotive, and access control.

At its core, this transformation is about making trust easier to establish and harder to compromise. That is where we focus our work.

4. Why did your organization join the DIACC?

Identita joined DIACC to help shape the future of digital trust in Canada. We see a strong fit between DIACC’s work on interoperability, privacy, and trusted identity frameworks and our own focus on secure, user-friendly identity technologies.

5. What else should we know about your organization?

This is our 22nd year in business and proudly family-owned.

DIACC’s Submission to the 2026 Review of the Privacy Act

Filed with the Treasury Board of Canada Secretariat, July 2026

The Privacy Act came into force in 1983 and has never been substantially updated. In April 2026, the Treasury Board of Canada Secretariat launched the first comprehensive review of it, outlining 23 policy proposals across 6 themes and asking two questions: Do you agree with the approach, and is anything missing?

DIACC filed its submission ahead of the July 10 deadline. This page sets out what we said, and why.

The submission is offered as analysis informed by member experience. It is not a position adopted on behalf of any individual member or government, and it does not advocate for any particular vendor or technology.

What we said, by theme

Theme 1: Enabling integrated services

Proposal 1 (sharing and reuse of personal data across programs, without consent, where a public interest or benefit to individuals is served). We support the direction. Replacing the default of repeated direct collection with a purpose-based approach is consistent with international practice and with the authoritative-source model that underpins modern digital service delivery. The four conditions attached to it are well calibrated: the reuse must be necessary, minimally intrusive, strongly safeguarded, and transparent.

Removing consent from the equation places considerable weight on those four conditions. They are the whole of the protection. Our submission’s position is that the conditions must be demonstrable in practice, not merely stated in statute, and that implementation guidance carries the load.

Proposal 2 (designated official sources of government digital data). This is the proposal we would most want to see survive the drafting process.

It would name certain institutions as the official source for specific types of personal data, and require other programs to obtain that data from the designated source rather than collect it again. The paper is candid that the driver is accuracy as much as convenience: under the current siloed model, a person who updates their information with one program and not with four others leaves the government holding several versions of the same person.

Provinces have been operating versions of this model for years. The BC Services Card serves more than 4.6 million British Columbians.[4] Quebec’s Government Authentication Service supports over 3.5 million accounts.[5] Alberta launched Canada’s first mobile health card in August 2025.[6] In the private sector, Interac’s sign-in service already carries more than 141 million federal government interactions annually.[8]

The consultation paper says designation would be guided by clear criteria and overseen by TBS, and that TBS could maintain a registry of official sources. We asked for three things in that work.

Auditable assurance frameworks should inform designation criteria, so that designation means an institution is held to a consistent and verifiable standard rather than simply named to a list.

The registry should be public and written in plain language, so that a Canadian can find out which institution is the official source of their data. A registry that exists only as an internal administrative instrument does less to build trust than one that people can actually read.

The model should be built for federal-provincial interoperability from the outset. Health, benefits and employment data cross that boundary constantly, and the paper itself allows that the approach could be extended across levels of government. Designing for that later is harder than designing for it now.

Theme 2: Enhancing accountability and transparency

We support all four proposals in this theme.

Elevating Privacy Impact Assessments to a legal requirement (Proposal 3) and publishing plain-language summaries of them strengthens accountability without imposing an unreasonable burden. Replacing the fragmented Personal Information Bank regime with a single centralized registry of personal data holdings (Proposal 4) is a straightforward improvement in service design and in transparency.

Regarding the automated decision proposals (Proposals 5 and 6), we support the direction but think something is missing from them.

The proposals would require institutions to notify individuals when an automated decision system is used and, upon request, explain how a decision was made and what data informed it. As those systems take on more consequential decisions, an institution’s ability to establish who the data subject actually is, and on what basis their consent was captured, does more work than it used to. Identity and consent assurance should be addressed in the Act’s automated decision provisions themselves, working alongside the Directive on Automated Decision-Making rather than being left entirely to it.

Theme 3: Advancing safeguards across the spectrum of data sensitivity

We support all five proposals in this theme.

Recognizing a spectrum of data sensitivity and identifiability in law (Proposal 7) is overdue, and the proposed categories align with international standards and provincial regimes. Creating legal requirements for breach management, notification, and reporting (Proposal 8) brings the Privacy Act into line with PIPEDA and international peers and is foundational.

Requiring safeguards proportionate to sensitivity (Proposal 9) is appropriate. We note that auditable assurance frameworks provide institutions with a demonstrable means of evidencing that physical, technical and administrative safeguards meet the legal requirement, rather than merely asserting that they do.

The necessity test for collection (Proposal 10) and the retention and disposal requirements (Proposal 11) are well calibrated. Institutions applying them will need to document, on a defensible basis, the authority and the retention rule applicable to each category of data they hold.

Theme 4: Modernizing the foundation for privacy and trust

We support all four proposals in this theme.

Recognizing privacy as a fundamental right while also naming service delivery as an objective (Proposal 12) resolves a tension that has never existed. Privacy protection and modern digital service are not competing goods, and a statute that says so plainly permits institutions to pursue both.

Listing privacy principles in the Act (Proposal 13) and aligning them with PIPEDA, the GDPR, and OECD guidelines reduce the interpretive burden for organizations working across federal, provincial, and private-sector regimes at once. We put particular weight on privacy by design, necessity, proportionality, effectiveness, and minimal intrusiveness.

Consistent definitions (Proposal 14) and a harmonized request regime (Proposal 15) are practical improvements that will be felt by anyone who has tried to request the current framework.

Theme 5: Indigenous Peoples’ access to, and protection of, their data

Our answer here was mostly deference.

Provisions governing Indigenous data must be developed in direct partnership with Indigenous governments and organizations, recognizing their distinct rights, perspectives, and priorities. We support the directional intent to recognize Indigenous data sovereignty and enable Indigenous governments to access their citizens’ data through formal agreements. On the substance of how those provisions should be drafted, and on the terminology the Act should adopt, we defer to Indigenous partners.

DIACC is engaged in exploratory dialogue with Indigenous organizations on co-design opportunities in digital trust. DIACC and its members can help build what those partners design. We are not the right authors of it.

Theme 6: Updating the compliance framework

We support the proposals in this theme.

We give particular weight to Proposal 20, which would authorize the Privacy Commissioner to share information with other oversight bodies. Canadians’ data moves among federal, provincial, and international regimes, and coordinated oversight across those regimes is a precondition for trusting that it is consistently protected as it travels.

We also support binding order-making powers and published corrective action plans (Proposal 19), offences for unauthorized re-identification (Proposal 21), expanded Federal Court authority (Proposal 22), and a mandatory five-year review (Proposal 23). Together these move the Act from a framework that describes obligations to one that can enforce them.

What we said was missing

The consultation’s second question is the more interesting one. Our answer had four parts.

The proposals stop short of the proof. A statute sets obligations. It does not settle how an institution demonstrates it has met them; that gets worked out afterwards in Treasury Board policy, in implementation guidance, and in whatever frameworks institutions end up using to evidence compliance. The consultation paper is detailed on the obligations and thin on the proof. More than 250 federal institutions will have to supply it.[10]

Auditable, technology-neutral assurance frameworks are one available means of closing that distance, across identity verification, consent management, automated decision-making, designated official sources, and inter-institutional sharing. They can be certified by independent third-party audit. Canadian industry and several provincial governments already operate on them. The Pan-Canadian Trust Framework is one such example, and Appendix B below shows how its components align with individual proposals. We offer that as information as an educational and operational example..

Independent certification is a recognized means of evidencing assurance. Where an institution needs to show that a service meets defined privacy and verification criteria, including in procurement, third-party certification against a published, technology-neutral framework is one auditable means of doing so.

Alignment with provincial regimes should happen at the principles and assurance layer. Canadians do not experience federal, provincial and municipal services as separate jurisdictions. Aligning at the level of principles and assurance, rather than attempting to align the legislative text, would allow a modernized Act to sit alongside BC’s FIPPA, Alberta’s FOIP, Quebec’s Law 25 and Bill 82, and Ontario’s regime without asking any jurisdiction to give up its authority.

Privacy reform is also service reform, and it bears on fraud. Canadians reported more than $704 million in fraud losses in 2025.[1] Synthetic identity fraud has climbed sharply as a share of credit applications.[2] Canada’s suspected digital fraud rate reached 4.4% of attempted transactions in 2025, above the global average of 3.8%.[3] The assurance sitting underneath federal identity and verification affects people’s money as well as their privacy. A modernized Act that supports auditable, interoperable assurance strengthens public trust and bolsters the digital economy, which depends on trusted federal data.

Appendix A: About DIACC and the Pan-Canadian Trust Framework

DIACC is Canada’s non-profit public-private forum on digital trust and verification, established in 2012 following the recommendations of Finance Canada’s Electronic Task Force for the Payments System Review. Our membership includes federal institutions, provincial and municipal governments, and the financial, telecommunications and technology partners that build and operate digital services with them.

The Pan-Canadian Trust Framework (PCTF) is an auditable conformance framework for identity, authentication and verification services. It is technology-neutral, built around privacy-by-design principles, and structured to support interoperability across federal, provincial and private-sector regimes.

DIACC’s PCTF Trustmark program certifies services against PCTF criteria through an independent third-party audit. Certified services are listed publicly on the DIACC Trusted List.

DIACC’s strategic priorities for 2026 to 2031 are AI trust and resilience, economic sector acceleration, regulatory alignment and compliance, and inclusive digital sovereignty.

Appendix B: How PCTF components align with the proposals

The PCTF was built around principles consistent with the policy approaches in the consultation paper. The following is offered for the reference of anyone interested in how an existing auditable framework maps to the proposals. It is not a recommendation that TBS adopt the PCTF, and DIACC does not advocate for any vendor or technology.

Proposal 1 (responsible sharing and reuse). PCTF identity verification and authentication profiles support the conditions attached to responsible sharing: necessity, minimal intrusiveness, and strong safeguards. The criteria are auditable, providing institutions with a defensible basis for inter-institutional sharing.

Proposal 2 (designated official sources). PCTF provides certifiable assurance criteria for institutions seeking designation, supporting consistent trust standards across designated sources.

Proposal 3 (mandatory PIAs). PCTF profiles include privacy-by-design criteria that map to PIA requirements.

Proposal 5 (transparency for AI and automated decision systems). DIACC’s AI verification and Verified Agent (Know Your Agent) criteria, currently in development, are designed to support transparency and explainability requirements for AI-supported decision systems.

Proposal 6 (strengthened privacy notices). PCTF consent criteria support plain-language notice requirements.

Proposal 7 (sensitivity spectrum). PCTF assurance levels apply proportionate safeguards based on the sensitivity and identifiability of the data being verified or authenticated.

Proposal 8 (breach management and notification). PCTF certification requirements include breach response and notification protocols.

Proposal 9 (legal safeguard requirements). PCTF certification provides auditable evidence that physical, technical and administrative safeguards meet defined criteria.

Proposal 12 (privacy as a fundamental right; service delivery as an objective). The PCTF was designed to support both privacy protection and modern digital service delivery.

Proposal 13 (principles aligned with private sector and international standards). PCTF principles align with PIPEDA, the GDPR and OECD guidelines.

Appendix C: Provincial and industry implementations

These implementations show how the policy approaches in the consultation paper can work in practice, and where the interoperability opportunity lies for a modernized federal Privacy Act. They are offered as illustrations. DIACC does not speak on behalf of any province or company.

British Columbia. The BC Services Card has been operational since 2013 and now serves more than 4.6 million British Columbians, over 90% of the province.[4] It supports federal interactions, including StudentAid BC and the Canada Revenue Agency. OrgBook BC, launched in January 2019, was the first implementation in North America to use verifiable credentials for organizational identity, and now covers over 1.4 million active legal entities. BC demonstrates the designated-official-source model at provincial scale, including federal-provincial interoperability.

Quebec. The Government Authentication Service, which replaced clicSÉQUR, supports more than 3.5 million accounts. Bill 82, passed on October 28, 2025, establishes the legal framework for a comprehensive digital identity and wallet capability by 2028.[5] Quebec shows that a legal framework for digital identity can be designed to sit comfortably inside a strict privacy regime.

Alberta. Alberta launched Canada’s first mobile health card on August 29, 2025, through the Alberta Wallet app.[6] Parents can hold their children’s cards, and paper alternatives remain available. Alberta shows how sensitive personal data can be made available digitally while upholding privacy-by-design principles and preserving non-digital alternatives.

Industry. Interac’s sign-in service supports more than 141 million federal government interactions annually,[8] and Interac Verified, launched in May 2025, implements a verify-once model that stores data locally on the user’s device.[7] Canadian-controlled assurance infrastructure is operational and already working at federal scale.

International context. The EU Digital Identity Wallet is in active rollout. Commission Implementing Regulation (EU) 2026/798 on wallet enrolment was published on April 8, 2026, and all member states must make at least one compliant wallet available by December 24, 2026.[9] Privacy and digital identity infrastructure are increasingly being designed to interoperate across jurisdictions.

Citations

[1] Competition Bureau Canada, “Fraud Prevention Month to bring hidden crime into the spotlight” (March 6, 2026), citing data from the Canadian Anti-Fraud Centre.

[2] Equifax Canada, “Equifax Canada Reports Rise in Automotive Fraud” (September 24, 2024). Synthetic identity fraud rose from 2.8% of credit applications in Q2 2023 to 8% in Q2 2024.

[3] TransUnion, “H1 2026 Update to the Top Fraud Trends Report” (May 13, 2026).

[4] DIACC, “Identity in Action Case Study: BC Services Card” (March 2019); Government of British Columbia, OrgBook BC.

[5] Government of Québec, “About the Government Authentication Service”; ID Tech, “Quebec Passes Landmark Digital ID Law” (October 2025).

[6] ID Tech, “Alberta Launches Canada’s First Mobile Health Card Through Alberta Wallet” (September 2025).

[7] Interac, “Interac launches the Interac Verified credential service” (May 2025).

[8] Interac, “Secure. Trusted. Helping Canada navigate a digital future” (October 2025).

[9] European Commission, Commission Implementing Regulation (EU) 2026/798 on wallet enrolment (published April 8, 2026).

[10] Treasury Board of Canada Secretariat, “2026 Review of the Privacy Act: Policy Approaches” (April 2026).