ID scan technology at Alcanna liquor stores collected too much data, says investigation

An identification scanning program used by some Alberta liquor stores violated provincial privacy laws by collecting more information than allowed from customers' driver's licences, an investigation has found.  

The findings from the Office of the Information and Privacy Commissioner (OIPC) were released Thursday. 

Alcanna, which operates liquor stores in Alberta under the brands Liquor Depot, Ace Liquor Discounters and Wine and Beyond, launched the pilot program with support from Edmonton police at three stores in January 2020. 

The program uses scanning technology developed by Patronscan, a Calgary-based company. Customers scan their government-issued identification to unlock a door into the store. 

Alcanna hoped the program would help reduce theft and said information would only be kept for 90 days unless a customer committed a crime. 

• Alberta privacy commissioner launches probe into liquor store ID-scan system
• Edmonton liquor store to combat crime by requiring customers to scan ID before entering

However, the investigation found that Alcanna was collecting and retaining more information than is allowed under Alberta's Gaming, Liquor and Cannabis Act. 

The act allows licenced premises like nightclubs and liquor stores to collect names, ages and photographs. However, the system used by Alcanna was also collecting information stored in the driver's licence bar code, which includes gender and a partial postal code. 

That contravened the Personal Information Protection Act (PIPA), the legislation that regulates the private sector, said the report.

The investigation made 16 findings and five recommendations. Alcanna already complied with the first recommendation when it moved in February to stop collecting gender and postal codes.

Safer stores

Taylor Mann, Alcanna's director of corporate investigations and organized retail crime, said the company has already complied with the remaining recommendations. The company changed its signage to clarify what information is being collected and where to call with questions. The company has also developed policies and procedures for rolling out the technology to other stores.

Scanners are now used at seven stores in Edmonton and two in Calgary. The company has reduced the time it holds data from 90 to 21 days, Mann said. 

He said the technology has dramatically reduced thefts and cash robberies. 

"People feel safer," he said. "It creates a safe shopping environment and safe work environment."

Mann said the company is happy the investigation is over and acknowledges a privacy assessment should have been done.

He said Patronscan believed that the technology had been vetted by the privacy commissioner. 

When the project was launched in January 2020, Alcanna's CEO James Burns said that Patronscan had been working "with privacy offices in Alberta, Canada, across North America, to make sure this is all privacy compliant with both laws and norms of society."

But the report by the privacy commissioner's office says that isn't true. Commissioner Jill Clayton said her office wasn't aware of the project until it was announced at the news conference. 

Patronscan was relying on a privacy impact assessment from 2009. The company's chief executive officer told CBC News in January 2020 that the company didn't reach out to the privacy commissioner because the pilot project used the same technology that had been in bars for more than a decade. 

But Clayton suggested the use of identification scanners at a bar and use at a retail liquor store are not the same. 

"The findings from a review by my office are only as valid as the representations and information made available to us, and PIA (privacy impact assessment) acceptance is not a 'seal of approval' for marketing purposes, particularly when a technology is implemented in a new and different way, in a different context," she wrote in the report.