 |
| Jay Krushell |
1) By examining the physical copy of a government-issued ID (In-Person Government-Issued ID Method);
2) By using verification technology to authenticate the government-issued ID (Virtual Government-Issued ID Method);
3) The Credit File Method; or,
4) The Dual-Process Method.
2) By using verification technology to authenticate the government-issued ID (Virtual Government-Issued ID Method);
3) The Credit File Method; or,
4) The Dual-Process Method.
All the identification methods listed above, with the exception of the In-person Government-Issued ID Method, require the use of technology. For example, the only way a lawyer can satisfy the requirements of the Credit-File Method is to establish an electronic connection with one of Canada’s two credit bureaus to facilitate the downloading and analysis of information from the client’s credit file. This raises the obvious question of which technologies can, or should, a lawyer use to make sure they are satisfying the requirements of their law society’s client ID rules?
This is where things get tricky because although the Federation of Law Societies of Canada and Canadian Law Societies have adopted these technology-dependent client ID rules, they have all repeatedly stated they do not vet, approve or endorse vendors of digital ID technologies or their products. In the past, this has left lawyers on their own to figure out which technologies are trustworthy, reliable and also satisfied the requirements of the
Sorapop: ISTOCKPHOTO.COM
Fortunately, several law societies have amended their guidance on the client ID rules to provide some very helpful information related to the selection of digital ID technologies. More specifically, they have started referring lawyers to resources published by the Digital Identification and Authentication Council of Canada (DIACC). DIACC is a non-profit coalition of private and public sector entities that, at a high level, works to enable Canada’s participation in the global digital economy.
The following is a sample of the DIACC-related guidance the law societies have published:
1) Guidance from the Law Society of British Columbia and the Law Society of Saskatchewan (LSBC, LSS)
Use authentication technology to confirm that the photo identification the individual sent is genuine. Refer to the DIACC’s Member Services Directory for technology vendors who have applied to be listed.
2) Guidance from the Law Society of Manitoba (LSM)
Use a DIACC certified software service that can confirm the authenticity of government photo ID and match the result to the image or video of the client.
3) Guidance from the Law Society of Ontario (LSO)
To assist individuals and organizations in identifying technology products available to help authenticate identity documents, DIACC has developed a directory of products that assess identification documents and verify identity (DIACC Member Services Directory). The first iteration of the DIACC Member Services Directory was released in May 2020 and it was subsequently updated in May 2021.
The DIACC Member Services Directory provides an overview of technology products that use government-issued photo identification cards combined with biometric facial scans to verify and authenticate identity documents.
4) Guidance from the Nova Scotia Barristers’ Society (NBSS)
Authentication technology is still new and is just being introduced in Nova Scotia. The NSBS does not currently envisage being able to approve particular technologies/service providers. The onus is on the lawyer to ascertain whether their preferred choice satisfies the burden on them to verify the authenticity of the ID.
DIACC regularly posts information on technology providers, including details of the applications of various authentication services. DIACC also publishes providers’ responses to the questions in the application, so lawyers can review these with a view to assessing the providers.
5) Guidance from the Law Society of Alberta
The Law Society of Alberta (LSA) doesn’t vet or endorse vendors or their products. There are several reputable companies that offer products that use authentication technology to verify identity in accordance with the virtual verification method.
To assist individuals and organizations in identifying such solutions, DIACC has developed a certification process for providers. Lawyers can seek out providers with this certification as a starting point when exploring digital authentication and verification technology options.
Use authentication technology to confirm that the photo identification the individual sent is genuine. Refer to the DIACC’s Member Services Directory for technology vendors who have applied to be listed.
2) Guidance from the Law Society of Manitoba (LSM)
Use a DIACC certified software service that can confirm the authenticity of government photo ID and match the result to the image or video of the client.
3) Guidance from the Law Society of Ontario (LSO)
To assist individuals and organizations in identifying technology products available to help authenticate identity documents, DIACC has developed a directory of products that assess identification documents and verify identity (DIACC Member Services Directory). The first iteration of the DIACC Member Services Directory was released in May 2020 and it was subsequently updated in May 2021.
The DIACC Member Services Directory provides an overview of technology products that use government-issued photo identification cards combined with biometric facial scans to verify and authenticate identity documents.
4) Guidance from the Nova Scotia Barristers’ Society (NBSS)
Authentication technology is still new and is just being introduced in Nova Scotia. The NSBS does not currently envisage being able to approve particular technologies/service providers. The onus is on the lawyer to ascertain whether their preferred choice satisfies the burden on them to verify the authenticity of the ID.
DIACC regularly posts information on technology providers, including details of the applications of various authentication services. DIACC also publishes providers’ responses to the questions in the application, so lawyers can review these with a view to assessing the providers.
5) Guidance from the Law Society of Alberta
The Law Society of Alberta (LSA) doesn’t vet or endorse vendors or their products. There are several reputable companies that offer products that use authentication technology to verify identity in accordance with the virtual verification method.
To assist individuals and organizations in identifying such solutions, DIACC has developed a certification process for providers. Lawyers can seek out providers with this certification as a starting point when exploring digital authentication and verification technology options.
As referenced in the above-noted guidance, DIACC provides two basic services related to digital identification companies and their products. First, it offers a directory of digital ID providers that is searchable and is designed to answer specific questions lawyers might have about digital ID products and how they comply with the client ID rules. This is the “directory” referenced in the LSO, LSBC and LSS guidance and the “information” referenced in the NSBS guidance. Second, as referenced in the guidance published by the LSA and LSM, DIACC administers a rigorous certification program, similar to the ISO and SOC 2 certification programs, that is specifically designed for digital ID technologies. Through this program, digital ID companies can be audited against the DIACC developed standards by an independent third-party auditor and, if they pass, they are awarded a DIACC trust mark. It is this certification program that the LSA and the LSM are referring to in their respective guidance.
In addition to the two services listed above, DIACC is in the process of finalizing a set of technical criteria that are specific to the client ID rules adopted by Canadian law societies. When these additional criteria are finalized the summer of 2025, digital ID companies can be audited against them and, if they pass the audit, earn DIACC’s “Law Society Profile” trust mark. If a company earns this trust mark it will have demonstrated a strict compliance with the technical requirements of the client ID rules.
To summarize, while the Federation of Law Societies of Canada and the Canadian Law Societies are not in a position to provide specific guidance on the digital ID technologies a lawyer needs to use to comply with the three virtual identification methods, their guidance directing lawyers to DIACC for information is very helpful. Further, the DIACC certification process is an independent and objective measure of a digital identity verification platform’s compliance with the client ID rules and lawyers looking to utilize digital ID technologies may find it useful to refer to the DIACC member directory and look for companies who have earned one or more of the DIACC trustmarks.
Jay Krushell is the co-founder, chief legal officer and VP of business development for Treefort Technologies Incorporated, an Edmonton-based cybersecurity and digital identity business. Krushell went to law school at the University of Alberta and was called to the Bar in 1999. He articled at Witten LLP in Edmonton, and he stayed with the firm as an associate and then a partner until 2021 when he left private practice to join Treefort full-time. Since then, he has developed an expertise on digital identity technologies and digital identity law, and he presents on these topics frequently. He can be contacted on LinkedIn or at jkrushell@treeforttech.com.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of the author’s firm, its clients, Law360 Canada, LexisNexis Canada or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.
Interested in writing for us? To learn more about how you can add your voice to Law360 Canada, contact Analysis Editor Peter Carter at peter.carter@lexisnexis.ca or call 647-776-6740.