Privacy commissioner flags issues with ID-scanning at Alberta liquor stores

Through an investigation, Alberta’s privacy commissioner found that Alcanna has been storing too much personal information by scanning customers’ ID and hasn’t been providing adequate details in its privacy notices to customers who have questions or concerns about the collection of their personal data.

Alcanna Inc., owner of the Liquor Depot, Ace Liquor, Wine and Beyond and Nova Cannabis brands, launched a pilot project in January 2020. It installed an identification-scanning entry system from company PatronScan at several locations across Alberta. The goal was to reduce the number of violent robberies at liquor stores.




Click to play video: Edmonton-based grant launched to combat liquor store theft

Global News has reached out to Alcanna for comment. This article will be updated when a response is received.

Read more:
Quartet of Calgary liquor stores to install customer ID-scanning system

In an investigation report published Thursday, the Office of the Information and Privacy Commissioner released 16 findings and five recommendations under the Personal Information Protection Act (PIPA) to Alcanna in relation to its use of Servall Data Systems’ Patronscan ID-scanning technology in liquor stores.

Alcanna and Servall committed to address each of the recommendations, the OIPC news release said.




Click to play video: Edmonton liquor store ID scanning pilot to expand after reducing crime 93%: police

Gender, partial postal code retained

The investigation found that the Gaming, Liquor and Cannabis Act (GLCA) authorizes Alcanna to collect and use “name, age and photograph” in order to decide whether to grant entry to an individual.

GLCA also authorizes the disclosure of this information to other licensees, and requires the information be disclosed to a police officer upon request.

So, Alcanna collecting customers’ name and age “is reasonable,” the OIPC found. That information can be used to identify someone involved in a criminal activity and does not require consent, the report explained.

Read more:
Alberta privacy commissioner investigating Alcanna’s use of ID scanning at liquor stores

However, OIPC found that Alcanna, through the Patronscan system, “examines all the information encoded in a driver’s licence barcode, and retains gender and partial postal code in addition to name and age, which contravenes PIPA’s provisions on limited collection and use of personal information.”

“Overall, this investigation highlights two important issues,” said Jill Clayton, Information and Privacy Commissioner.

“The first is that it is clear the legislature intended the 2009 amendments to the GLCA to authorize licensed premises to collect some limited personal information for specific purposes related to investigating and ultimately reducing crime.

“However, the current language of the GLCA presents a number of practical challenges, particularly when it comes to the use of ID-scanning technologies.

Read more:
ID scanning pilot project launched to combat Edmonton liquor theft epidemic

“I intend to follow-up with government and other stakeholders on this point to articulate these challenges and discuss possible solutions,” she said.




Click to play video: Edmonton liquor store ID scanning pilot to expand after huge drop in thefts

Privacy notice inadequate

The OIPC investigation also found the privacy notice in Alcanna’s stores “was inaccurate and did not provide adequate contact information in case individuals have questions about the collection of their personal information as required by PIPA.

“The privacy notice did not accurately identify the personal information that is collected or the purposes for that collection.”

Technology not ‘approved’ by OIPC

Clayton also pointed out that “acceptance of a privacy impact assessment is not a ‘seal of approval’ for marketing purposes, particularly when a technology is implemented in a new and different way in a different context.”

When Alcanna announced it would be using Patronscan technology in January 2020, company representatives said it had been “approved” by the OIPC, Thursday’s news release said.

“The OIPC, however, was not aware of the pilot project until it was announced.

“The OIPC learned that Servall relied on a 2009 privacy impact assessment (PIA) review of its technology as evidence that the technology complied with PIPA, as well as previous investigations of the technology implemented in nightclubs.”

Read more:
Edmonton police propose mandatory ID scanners at bars

However, years ago, OIPC had told Servall: “The OIPC cannot endorse or even approve Servall’s product as ‘privacy-compliant.’”

This investigation serves as a reminder to all businesses that the way in which technology is implemented and what features are engaged, along with several other important considerations such as context, can have substantial implications for compliance,” Clayton said.

“The findings from a review by my office are only as valid as the representations and information made available to us.”




Click to play video: Lawyer discusses ID scanning at cannabis stores

© politic.gr
WP2Social Auto Publish Powered By : XYZScripts.com