Last month, Privacy Commissioner Jill Clayton ordered Budget Rent-a-Car to stop holding on to driver's licence information of its clients.
Mohamed Ali, who co-owns the Calgary franchises, says he began taking copies to try to catch the people who steal rental vehicles.
"For us, it's strictly protection of our asset," he said. "It's the picture we're interested in, not in the driver's licence number."
"When you return the vehicle, we can give it back to you or shred it," Ali added.
But according to the province's privacy commissioner, shred it or not, there's no point in having the information in the first place.
However, Clayton's office said in a news release the company does not have the authority to take that information and couldn't provide enough of an explanation to justify it.
"Though the answers drew on the combined experience of Staff Sgt. Drennan and the detectives in the fraud and auto theft units over the course of several years, there was reference to only a single case in which the photocopy of the image of a fraudulent thief was successfully used to identify that person through facial recognition software," Clayton's office said.
But several weeks later, Budget keeps making the photocopies.
Company faces deadline
Privacy expert Rick Klumpenhouwer says companies shouldn't take that type of information unless it's absolutely necessary.
"The big issue here is photocopying the actual record, and keeping that as opposed to using the driver's licence to verify that you are who you are," he said.
The company has until mid-December to comply.
"Budget was slapped with the order because if you don't need a photocopy of someone's identification, you can't take it," Klumpenhouwer said.
Other types of businesses also keep a copy of your driver's licence, such as some nightclubs and car dealerships, when you take a test drive.
Consumers asked for a photocopy of their driver's licence can file a complaint, generally the first step if the privacy commissioner's office is going to get involved.
In this case, if Budget does not comply with the order, the privacy commissioner could take the company to court. However, the commissioner's office says that type of action has never been taken.