On Aug. 19, 2019, two hooded figures wearing face masks, backpacks and black clothes while carrying pistols, were caught on camera robbing an Edmonton liquor store.
Footage from other robberies show thieves wielding cans of mace and punching unsuspecting people in the face. For liquor store employees in Edmonton’s Northeast this kind of crime has become far too prevalent.
Patronscan pilot project
In 2019, the Edmonton Police Service responded to more than 9,500 thefts from liquor stores — an average of 26 per day. That was triple the 3,273 liquor store thefts seen in 2018.
These thefts are not exclusive to Edmonton. According to statistics from the Calgary Police Service, they responded to 2,490 liquor store thefts in 2019, and 297 of these robberies occurred in September alone.
In an attempt to curb that rise in theft Alcanna, Alberta’s largest liquor retailer, in partnership with Patronscan, an identification scanning system company, has implemented an ID-scanning pilot project at three Edmonton liquor store locations. But the Office of the Information and Privacy Commissioner of Alberta is concerned this novel security system might interfere with customers’ privacy — a concern the Privacy Act has little control over.
According to their website, Patronscan is an ID scanner that reads both a person’s government-issued ID and their eyes, comparing the two to authenticate and verify the customer’s identity. The scanner “verifies a patron’s age, confirms ID expiration date and catches fake IDs.”
Marko Milkotin, a public relations representative for Patronscan, says the system only collects the information necessary “to verify age, avoid an inaccurate match to the known list and for law enforcement investigations.” That includes the customer’s name, date of birth, photo, gender and postal code.
An infographic higlighting some of Patronscan’s features. Infographic courtesy of Patronscan.
According to their website, Alberta Patronscan stores this information for 21 days. That time allows “crime victims sufficient time to report a crime and for law enforcement to identify the alleged assailant(s). It is common for victims to report crimes several weeks later,” says Milkotin.
Those who have access to this data are the venue owner and the management staff.
During this time, “in case of a major incident concerning public safety, law enforcement may obtain access to a venue’s data, but only when an official investigation has been launched.”
Patronscan says that they “allow for businesses to track patron numbers, determine capacity, understand patron demographics.”
“Data is not cross-referenced with customer transactions or used for marketing purposes,” Milkotin says.
But there is some data that Patronscan holds onto: “non-personally identifiable data points such as postal/zip codes, age and gender,” along with the number of daily customer scans. This information is collected and summarized into reports.
Milkotin explains that most businesses use Patronscan as a way to protect their guests, staff and property, but it’s also an “investigative tool that assists local law enforcement with identifying patrons who have allegedly engaged in criminal activity.”
The scanner’s presence also acts as a deterrent, he says.
Progress with Patronscan
Alanna Towstego, an employee of a NE Edmonton Liquor Depot, says, “at first people were a little iffy about it.”
Her location installed a Patronscan scanner this past January. Towstego says the store’s regulars still come by though and “have no problem with it,” especially if it helps employees feel safer.
The Patronscan system at her location seems to be working.
“The people that are doing the crimes, generally they don’t have IDs,” says Towstego. “So they really can’t get in.”
“It’s definitely 100 per cent safer,” she says. “We [typically] would have one theft a day if not more.”
Towstego’s location only had two thefts within the first three months of the install.
OIPC investigation
Despite the security Patronscan says it provides, the Office of the Information and Privacy Commissioner (OPIC) began investigating the project three days after Alcanna and Patronscan publicly announced it on Jan. 20.
Scott Sibbald, a communications manager for the OIPC of Alberta, said the ongoing investigation will determine if the use of the technology in liquor stores complies with the Personal Information Protection Act (PIPA), Alberta’s private sector privacy law.
Under PIPA, an organization must receive an individual’s consent before collecting their information. Consent can be obtained verbally, in writing or through electronic communications. A person is considered to have given consent if they voluntarily provide the information or do not “opt-out,” regardless of if consent was actually given.
And that’s what Towstego says her store has done in the form of a blue poster outside with the words: “Scan your ID to enter the store.” In a slightly smaller font are the instructions to place the ID barcode under the green light. The doors will unlock if the ID is valid.
“We also have information cards we’re giving customers that don’t know how to use it and we have one of our staff that goes outside to explain how to properly use the scanner,” Towstego adds.
At liquor store locations with a Patronscan ID scanner, customers are required to place their cards under a green light to be scanned. If their card is valid, the doors will unlock and customers are free to enter. Photo courtesy of Patronscan.
Milkotin says the OIPC of Alberta has looked at their use of ID scanners in the past and found them to adhere to PIPA.
“Patronscan ID scanners found at many local bars and nightclubs are compliant with privacy laws,” says Milkotin. “It’s the same technology, different venue.”
Milkotin adds that if customers are interested in knowing how their personal information is being collected and used, they can visit Patronscan’s privacy page and submit an online disclosure form, a response will be given within 10 business days.
PIPA limitations
However, even if Alcanna and Patronscan were found not to comply with Alberta’s privacy law, the Privacy Commissioner does not have the authority to force a company to close or even administer a financial penalty.
Introduced in 2004, PIPA provided a framework for Alberta private sector organizations to follow in their collection, use and disclosure of personal information.
Additionally, it established privacy rights for Albertans, including the right to have their information protected and the right to request access to their information.
“At the time, PIPA was developed to ensure privacy compliance would not be too onerous for small and medium-sized businesses,” says Sibbald. “Much has changed in society since PIPA was enacted, in large part due to the exponential growth of the information economy.”
But the Act hasn’t reflected that growth. Sibbald references the European Union’s General Data Protection Regulation (GDPR) that was introduced in May 2018 as a model Alberta can look to if they want to improve PIPA.
“The GDPR has strict legal requirements for informational privacy, including consent, mandatory breach reporting and notification, and being able to demonstrate compliance with GDPR’s principles,” says Sibbald.
The GDPR also has the ability to fine non-complying organizations up to €20 million, or over $30 million CAD.
Although there has been discussion of stricter enforcement measures in Canada, no amendments have been introduced in private sector privacy laws.
“There continues to be talk of reforms federally,” says Sibbald. “Any changes federally would likely influence change in Alberta.”