The Office of the Information and Privacy Commissioner (OPIC) of Canada published on Thursday the findings of its investigation into Alcanna Inc.’s retail liquor stores in Alberta. The investigation found that Alcanna’s use of ID scanning technology violated the Personal Information Protection Act of Alberta (PIPA) by collecting more than the reasonable extent of personal data.

The investigation was opened on 23 January 2020, owing to widespread privacy concerns in the media after Alcanna announced the launch of an ID-scanning pilot project at three liquor stores in Edmonton. The project would use the Patronscan technology operated by Servall Data Systems Inc. The project required individuals to scan the barcode on the back of their driver’s license to enter liquor stores and was aimed at addressing the increasing incidents of thefts, robberies, and violence at Alcanna’s stores.

The OPIC noted that while Section 69.2 of the Gaming, Liquor, and Cannabis Act of Alberta (GLCA) allowed the collection of a person’s name, age, and photograph before allowing a person to enter licensed premises, Alcanna was collecting additional information on gender and partial postal codes for “more accurate identification.” Further, although the system did not retain all the information on the driver’s license barcode, it does initially decode and process it to extract the relevant information.

The OPIC found that the limited period of time that it collects such information and the additional collection, use, and disclosure of gender and partial postal code information is beyond the extent reasonable to meet the stated purpose of identifying individuals involved in criminal activity.

The OPIC also found that while consent for collecting information relating to name, age, and photographs was exempted under the GCLA, Alcanna was not obtaining due consent for the collection, use, and disclosure of the additional information relating to gender and postal codes.

Consequently, Alcanna’s project contravenes sections 11(2), 16(2), and 19(2) of PIPA. The OPIC recommended that the company cease collecting personal information beyond the elements permitted under the GLCA.

Jill Clayton, the Information and Privacy Commissioner, stated:

“…this investigation serves as a reminder to all businesses that the way in which technology is implemented and what features are engaged, along with several other important considerations such as context, can have substantial implications for compliance.”