“I’m sorry! Why are you scanning my ID? What do stores see when they scan my ID?

BY SIMONE J. SMITH

Privacy is one of our fundamental human rights, and for some reason, over the last few years, it always feels like this right is being violated. There have been reports of storekeepers holding a scanner above shoppers’ driver’s license or ID cards. A video recently surfaced where a shopper had to scan her ID card in order to gain access to items in a refrigerator. This concern may have you thinking: what exactly do stores see when they scan my ID?

I am going to start by saying that as consumers, we have to do our due diligence and take the time to read a store’s privacy policy. It is the only way to determine what a store sees from an ID. Your ID does contain personal information, and stores can potentially see all of this data when they scan it. They can see information ranging from your name to your date of birth, everything on the ID, and sometimes more.

The most concerning part is that stores can legally store all of this information in a database under the context of “fraud prevention.” While your name and age should be sufficient for any use they may have, it is up to the store to decide if they limit the information to that small set.

There was an investigation opened on January 23^rd, 2020, due to widespread privacy concerns in the media after Alcanna announced the launch of an ID-scanning pilot project at three liquor stores in Edmonton. The project would use the Patronscan technology operated by Servall Data Systems Inc. The project required individuals to scan the barcode on the back of their driver’s license to enter liquor stores and was aimed at addressing the increasing incidents of thefts, robberies, and violence at Alcanna’s stores.

In a statement they shared, “We are confident that this partnership with the Calgary Police Service to introduce controlled entrances in Calgary will show the same drastic reduction in thefts and robberies as our pilot program in Edmonton has demonstrated.”

The Patronscan device collects a customer’s name, age and photograph. The information is then stored on Patronscan’s secure server for 21 days. Store personnel cannot access the information and police officials can only do so if a crime has been committed.

This obviously did not sit well with certain individuals, and the Office of the Information and Privacy Commissioner (OPIC) of Canada published the findings of their investigation into Alcanna Inc.’s retail liquor stores in Alberta. The investigation found that Alcanna’s use of ID scanning technology violated the Personal Information Protection Act of Alberta (PIPA) by collecting more than the reasonable extent of personal data.

The OPIC noted that while Section 69.2 of the Gaming, Liquor, and Cannabis Act of Alberta (GLCA) allowed the collection of a person’s name, age, and photograph before allowing a person to enter a licensed premises, Alcanna was collecting additional information on gender and partial postal codes for “more accurate identification.”

Although the system did not retain all the information on the driver’s license barcode, it did initially decode and process it to extract the relevant information.

The OPIC found that the limited period of time that it collects such information and the additional: collection, use, and disclosure of gender and partial postal code information is beyond the extent reasonable to meet the stated purpose of identifying individuals involved in criminal activity.

This stretches back further than 2020. In 2017, an Edmonton man raised concerns about privacy rights after his ID was scanned while buying cigarettes.

Naturally, some of us will be uncomfortable if someone takes our ID and scans it, so if you’re not comfortable letting out all the information on your ID to a store, I repeat; you should go through their privacy policy before shopping with them.

I did some research to see some of the rules that are enforced on stores who use ID scanners, so that you can intelligently call a store out if you are uncomfortable with their practices.

To use an ID scanner in Canada, a venue must do one of the following:

1.) If the data is not being stored in a database, then using an ID scanner is not an issue at all because it’s just like the bouncer looking (and immediately forgetting) the personal data on the ID.

2.) If the data is being stored, then a sign should be displayed at the ID scanning location which says something like:

• We are using an ID scanner to check age or
  We are using an ID scanner to check age and for marketing purposes
• We do this to protect our business and the patrons who visit our business
• The information collected will not be sold or rented
• Optional – We will delete this information after X days – Optional
• You have the right to opt out by simply not visiting our facility and we have the right to deny you admission to the facility
• If you allow your ID to be scanned, then you agree to let us use your driver’s license data for the use(s) specified above

You have the right to your privacy; never forget that.