Privacy commissioner OKs modified Barwatch program

According to the CBC, the Information and Privacy Commissioner of British Columbia has approved a modified version of the BarWatch program. Bars, under BC's Personal Information Protection Act, are allowed to swipe a patron's drivers license or other ID, collecting name, gender, date of birth and a photograph of the patron. The information must be deleted within 24 hours, except for "rowdies", whose information can be kept and exchanged with other bars through the BarWatch database. See: Privacy commissioner OKs Barwatch software.

For more information on this controversial practice, click on the link "ID SWIPING" below.

Federal Commissioner settles ID-swiping dispute

The Privacy Commissioner of Canada just recently announced a settlement has been reached in its application to the Federal Court to stop Canad Corporation of Manitoba from ID-swiping patrons of its nightclubs. This followed an investigation by the OPC that recommended the practice be terminated and that the data collected be destroyed. Canad refused to follow the OPC's advice, so the Commissioner commenced an application to the Court to have the matter dealt with there.

Here's the summary from the Commissioner's site.

Recent Court Activity

Settlement between the Privacy Commissioner of Canada and Canad Corporation of Manitoba Ltd.

Legal Update

The Privacy Commissioner of Canada has reached a settlement with the Canad Corporation of Manitoba Ltd (Canad Inns), a hotel chain that operates a number of night clubs in Manitoba. This settlement follows legal proceedings stemming from an investigation into the collection of personal information of bar patrons using a machine that copies and stores personal information appearing on the front of an identification card such as a driver’s licence.

The Office of the Privacy Commissioner’s investigation was prompted by a complaint from a Canad Inns customer who objected to having her licence information scanned.

The Privacy Commissioner’s office understood Canad Inns’ need to effectively verify the age of its patrons and to ensure an appropriate level of security in its night clubs. In addition to the identification machines, Canad Inns also used video surveillance, metal detectors, pat downs, security personnel and lists of banned people in order to secure the safety of patrons.

The investigation ultimately concluded that the machines collected more information than was necessary for those stated purposes and that the information collected was being retained for too long.

Canad Inns disagreed with recommendations to stop using the machines and to remove the personal information already collected by them.

As a result, the Privacy Commissioner filed a notice of application before the Federal Court to enforce the recommendations.

Following court-ordered mediation in early 2009, the Court gave Canad Inns a period of time to determine feasible means to limit the personal information it collects.

As part of the settlement between Canad Inns and the Privacy Commissioner, the company has made commitments to:

• Stop collecting personal information at its night clubs via its identification machines;
  
• Destroy the personal information collected with the machines; and
  
• Limit the amount of personal information found on its list of barred people and ensure that this information is adequately secured.

The Office of the Privacy Commissioner of Canada is pleased that Canad Inns has agreed to take steps to ensure that the privacy rights of its patrons are respected.

The Privacy Commissioner has agreed that it would not be unreasonable for Canad Inns to collect limited personal information (names, dates of birth and photos) from bar patrons and to retain that personal information for 24 hours. This is a similar approach to that taken in both British Columbia and Alberta, where provincial privacy commissioners have investigated similar issues.

A case summary of the Office of the Privacy Commissioner of Canada’s investigation is also available at: http://www.priv.gc.ca/cf-dc/2008/396_20080227_e.cfm.

BC Privacy Commissioner issues license swiping decision

Earlier this week, the Information & Privacy Commissioner of British Columbia issued a decision (P09-01) related to the controversial practice of scanning photo IDs of patrons by bars, pubs and night clubs.

From the Commissioner's media release:

FOR IMMEDIATE RELEASE

July 21, 2009

Information and Privacy Commissioner Releases Order on Driver’s Licence
Scanning

VICTORIA — Information and Privacy Commissioner David Loukidelis today released
Order P09-01, in response to a complaint about the scanning of a bar customer’s
driver’s licence. The customer complained that, when he went to the bar, employees
asked him to produce his driver’s licence, swiped it through a card reader and then
required him to have his digital photograph taken. He did not receive what he
considered to be a reasonable explanation for why his personal information was being
collected and later complained under B.C.’s Personal Information Protection Act
(“PIPA”), which regulates the collection, use and disclosure of personal information by
businesses.

The OIPC investigated the complaint twice and a formal hearing was eventually held.
In Order P09-01, the Commissioner has decided that section 7(2) of PIPA does not
allow the organization complained about, the Wild Coyote Club, to force its customers to
give up their personal information, to the extent this is now being done, as a condition of
being allowed into the bar.

Section 7(2) says a business “must not, as a condition of supplying a product or service,
require an individual to consent to the collection, use or disclosure of personal
information beyond what is necessary to provide the product or service.”
The Commissioner accepted that it is “necessary” to collect personal information of
certain customers for the purpose of operating a nightlife establishment, but not
“to develop and maintain a personal profile containing the personal information of all
customers in order to effectively track the few who may be removed from, and
subsequently barred from re-entering, an establishment. Certainly, the full scope of
information which is collected by Wild Coyote and the length for which it is retained is
not necessary to achieve that purpose” (para. 98). The Commissioner therefore found
that “a requirement for consent to the collection of personal information through the
TreoScope system is a requirement for consent to the collection and use of information
‘beyond what is necessary’ for providing the service of operating a nightlife
establishment in the terms I have described” (para. 98).

Section 11 of PIPA says a business “may collect personal information only for purposes
that a reasonable person would consider appropriate in the circumstances”.

The Commissioner found that, under s. 11 of PIPA, the collection of personal
information was not appropriate in the particular circumstances, including given the
nature and amount of personal information being collected. He found that “it is
reasonable, in the case of Wild Coyote, for it to be able, in order to preserve a safe
environment for customers, to identify those individuals who have been determined to
be violent, or otherwise undesirable for re-entry from a safety perspective, and thus
improve customer safety” (para. 127). He went on to say, however, that “much of the
information collected by the TreoScope system”, including driver’s licence numbers,
“does not further this safety purpose”, adding, “Moreover, I have not been provided with
any reason related to improved customer safety for an establishment’s retention of any
information at all relating to customers who are not involved in violent incidents”
(para. 127).

As regards moving forward with a system for keeping banned customers out of bars,
Loukidelis said this:

[132] Of course, I have received no submissions from the other parties on this
alternative, and no details from Wild Coyote on how the system would operate
if it were aimed at only maintaining a list of banned customers. As a result,
I can only decide whether or not the collection as a whole, as it was being
conducted at the time of the Investigation Report, complies with s. 11 of PIPA.
For reasons already given, I conclude that it is not. The alternative proposed in
Wild Coyote’s supplemental submissions would likely involve different
considerations and cannot be addressed here.

In closing, the Commissioner said this:

[151] … I am well aware of, indeed share, public concern about gang violence
and public safety in British Columbia. Some may assert that the technology
involved here is synonymous with safety, such that any decision perceived to
constrain ID scanning is a decision against safety. These are easy claims to
make, but my duty is to apply PIPA based on the evidence and argument
actually before me, which I have done.

[152] On the basis of the material before me, I have decided that it is
reasonable for Wild Coyote to be able, in order to preserve a safe environment
for customers, to identify those individuals who have been determined to be
violent or otherwise undesirable for re-entry from a safety perspective, and thus
improve customer safety. For the reasons given above, however, the collection
of personal information as a whole does not comply with PIPA. In this
light, and in view of the reasons given above, I invite –– indeed, strongly
encourage––those involved to seek the views of this Office if they wish to find
a solution for collecting personal information of a nature, and in a manner, that
complies with PIPA.

Neither the Commissioner nor the OIPC will be giving interviews or commenting on this
decision.

For previous posts on this topic, see the keywrd "id swiping".

Amendments to Alberta liquor legislation to re-permit info collection

Presuably to counteract the effects of the Information and Privacy Commissioner's decision that bans siping licenses at bars in the province (Alberta Commissioner forbids license scanning), the Alberta legislature is considering Bill 42 which permits the collection of similar information:

Legislative Assembly of Alberta - Bill 42: Gaming and Liquor Amendment Act, 2009

Collection of personal information by licensee

69.2(1) A licensee may, before allowing a person to enter licensed premises, collect the person’s name, age and photograph.

(2) If a licensee has personal knowledge or reasonably believes that a person referred to in subsection (1) has, at any time within the preceding year, engaged in an activity referred to in section 69(1) or (2), the licensee may, in good faith, disclose the person’s name, age and photograph to other licensees for the purpose of allowing them to determine whether they wish to allow the person to enter licensed premises.

(3) A licensee must, as soon as possible after a request is made by a police officer, disclose to the police officer any information collected under subsection (1).

Thanks to a correspondent for pointing this out ...

Bar watch program coming to Halifax

Following in the footsteps of British Columbia and Alberta, bar owners in Halifax are talking about rolling out a "Bar Watch" program. You can read about other programs here: id swiping.

What is particularly troubling or at the very least needs close scrutiny is the suggestion that the banned list is going to originate from the police. So far, I haven't seen what gives the police the right to decide who goes into licensed establishments and what criteria they will use. I haven't seen any detail about how it with be implemented and what information will be demanded from all bar patrons.

Stay tuned.

Bar owners see police role in managing ban (UNews)

The group spearheading a citywide bar-goer blacklist may rely on police to provide personal information of banned patrons, according to a spokesperson for the group.

"I'm assuming that the police would hand it over to us, I can't see why they wouldn't," said Richard Stevens of the Restaurant Association of Nova Scotia. "I'm fairly certain that that's the way it would go."

Stevens is a co-owner of the Pogue Fado Irish Public House, as well as chair of the association's government-affairs committee. That committee met Thursday with its partners in this project - the municipality, police and provincial liquor enforcement officials - and agreed in principle to proceed with the plan.

The Bar Watch program, as it's been dubbed, may begin as early as April, but there's a lot still up in the air. Though Stevens said he's just speculating at this point, maintaining a database of patrons barred from Halifax's drinking establishments would be key.

This list would likely contain "very basic biographical information about the person," such as name and address, he said. Some details of the incident that earned them their spot on the list may also be included, including names of witnesses and security staff involved.

The list would be maintained by the association, and only bar owners and general managers would be able to add people to it. Bar security would only see the names of banned patrons, not their full details.

"It would take a significant incident (to get on the list). This isn't anything that any of the owners take lightly," Stevens said.

"I'm assuming that probably 75 to 80 per cent of the people that end up getting barred, the police would probably end up getting involved anyway ... because it would be that serious."

Even if bar security have to restrain patrons involved in a fight or another serious incident, the bouncers have no right to search them for ID, he said.

"If they fail to provide identification, if and when they've been restrained after an incident, we'd call the police," he said. "The police would come and the police would get that information."

Stevens said he believes the police will provide the information necessary for the blacklist. Arrest records are public.

Police advising, but no word on further role

Halifax Regional Police spokesperson Cst. Brian Palmeter said the police's role "is to provide any guidance or assistance that they would ask from us."

"All that we're really saying about it is that we're aware the Restaurant Association has had some preliminary discussions about this ... We would support anything that any business would do to make it safer for their customers ... but as far as this goes, this is something that they're looking at doing. It's not a police matter."

At the time, Palmeter was not asked and did not comment on whether police would provide the association with personal information of patrons.

Stevens said the police have been advising the association on the administration of the program.

"They have a lot more experience with these programs than we do," he said. "They're guiding us along, providing advice, and they're going to stay by our side ... until we get this thing up and running."

Stevens said the police could be involved in this capacity for one to two years.

The next step in getting this program off the ground is a meeting with "the key stakeholders around HRM," which Stevens said he expects within the next two or three weeks.

"We'll target, with the help of the police force, 10 or 12 key establishments, contact the owners, and call them in for a meeting where we'll describe the program, its objectives, what we hope to accomplish, and ask them to get onboard."

New system takes ID swiping to a new level

I've written on this blog before about the practice of swiping drivers' licenses and other IDs at bars. The Omega--an independent student newspaper from Thompson River University--is reporting about a company that takes it to a new level by photographing all bar patrons:

Big brother at the bar? - Cactus Jacks implements new way to screen attendees

“We have a new monitoring system called Treoscope that everyone that comes into the pub must go through,” said Cactus Jack’s manager Pete Backus. “It takes your picture and also records your name and where you are from.”

The entire system has brought up privacy concerns. The B.C. privacy commissioner is ruling on the legality of the way Treoscope collects and stores information.

The B.C. Civil Liberties Association said Tresocope violates the Personal Information Protection Act and the collection and storage of information from driver’s licenses is not necessary to provide the services drinking establishments offer. The association has qualms over who can access personal information and any resulting identity theft.

The electronic identification system has been put in place because of rising levels of violence in the club. Cactus Jack’s now requires identification cards that have a magnetic swipe stripe containing the user’s name, address and age in order for entrance to be granted.

According to the Treoscope website, patrons’ personal information is safe because only the name and age are displayed, not the birth date. It also claims information can only be accessed by police if they have a proper warrant.

Treoscope EnterSafe’s software database is connected to other clubs’ computers that operate the same software. When there is an incident, a “community alert” is attached to the person’s name allowing all those connected to determine whether to allow a club-goer in or not.

“We use it for security for the patrons of the club,” Backus said, who added they have been trying to cut down on gang violence in and around the club. When they learn someone is an Independent Soldier or other gang member they go back to the stored information and flag the individual. “We are trying to get rid of that,” Backus said. “We are not allowing people into the club that are gang-related or if they come into a club and start a fight. When that happens we now have their picture and we can suspend them from the club for as long as we want.”