ID scan technology at Alcanna liquor stores collected too much data, says investigation

An investigation found that an identity scanning program used by some Alberta liquor stores violated provincial privacy laws by gathering more information than customers’ drivers licenses allowed.

The Office of the Information and Privacy Commissioner’s (OIPC) findings were released on Thursday.

Alcanna, which operates liquor stores in Alberta under the brands Liquor Depot, Ace Liquor Discounters, and Wine and Beyond, launched the pilot in three stores in January 2020 with the assistance of the Edmonton Police Department.

The program uses scanning technology developed by Patronscan, a Calgary-based company. Customers scan their government ID to unlock a door to the store.

Hoping the program would help reduce theft, Alcanna said information would only be retained for 90 days unless a customer committed a crime.

However, the investigation found that Alcanna collects and stores more information than is allowed under Alberta’s Gaming, Liquor and Cannabis Act.

The law allows licensed establishments such as nightclubs and liquor stores to collect names, ages, and photos. However, the system used by Alcanna also collected information stored in the barcode on the driver’s license, including gender and a partial zip code.

This violates the Personal Data Protection Act (PIPA), which regulates the private sector, the report said.

The investigation produced 16 findings and five recommendations. Alcanna followed the first recommendation in February to stop collecting gender and postal codes.

Safer business

Taylor Mann, director of corporate investigations and organized retail crime at Alcanna, said the company had already followed the remaining recommendations. The company has changed its signage to make it clearer what information is being collected and where to call if you have any questions. The company has also developed policies and procedures for introducing the technology into other stores.

Scanners are now used in seven stores in Edmonton and two in Calgary. The company has reduced the time in which data is stored from 90 to 21 days, said Mann.

He said the technology has drastically reduced theft and cash robbery.

“People feel safer,” he said. “It creates a safe shopping environment and a safe work environment.”

Mann said the company was glad the investigation was complete and admits that a privacy assessment should have been conducted.

He said Patronscan believed the technology had been reviewed by the data protection officer.

When the project kicked off in January 2020, Alcanna CEO James Burns said that Patronscan “worked with privacy offices in Alberta, Canada across North America to ensure that all privacy practices were compliant with both laws and society’s norms “.

But the report from the Office of the Data Protection Officer says this is not true. Commissioner Jill Clayton said her office was unaware of the project until it was announced at the press conference.

Patronscan relied on a 2009 privacy impact assessment. The company’s chief executive officer told CBC News in January 2020 that the company had not contacted the data protection officer because the pilot was using the same technology that it had been using for more than a decade.

However, Clayton suggested that using identification scanners in a bar and using them in a liquor store are not the same thing.

“The results of an examination by my office are only valid to the extent that the representations and information made available to us, and the PIA acceptance (Privacy Impact Assessment) is not a ‘seal of approval’ for marketing purposes, especially if a technology is in a new and different way and way, in a different context, “she wrote in the report.