By means of an investigation, Alberta’s privateness commissioner discovered that Alcanna has been storing an excessive amount of private data by scanning clients’ ID and hasn’t been offering sufficient particulars in its privateness notices to clients who’ve questions or considerations in regards to the assortment of their private knowledge.
Alcanna Inc., proprietor of the Liquor Depot, Ace Liquor, Wine and Past and Nova Hashish manufacturers, launched a pilot undertaking in January 2020. It put in an identification-scanning entry system from firm PatronScan at a number of areas throughout Alberta. The purpose was to cut back the variety of violent robberies at liquor shops.
World Information has reached out to Alcanna for remark. This text shall be up to date when a response is acquired.
In an investigation report revealed Thursday, the Workplace of the Info and Privateness Commissioner launched 16 findings and 5 suggestions below the Private Info Safety Act (PIPA) to Alcanna in relation to its use of Servall Knowledge Programs’ Patronscan ID-scanning know-how in liquor shops.
Alcanna and Servall dedicated to deal with every of the suggestions, the OIPC information launch mentioned.
Gender, partial postal code retained
The investigation found that the Gaming, Liquor and Cannabis Act (GLCA) authorizes Alcanna to gather and use “identify, age and {photograph}” with the intention to resolve whether or not to grant entry to a person.
GLCA additionally authorizes the disclosure of this data to different licensees, and requires the knowledge be disclosed to a police officer upon request.
So, Alcanna accumulating clients’ identify and age “is cheap,” the OIPC discovered. That data can be utilized to determine somebody concerned in a legal exercise and doesn’t require consent, the report defined.
Learn extra:
Alberta privacy commissioner investigating Alcanna’s use of ID scanning at liquor stores
Nonetheless, OIPC discovered that Alcanna, by the Patronscan system, “examines all the knowledge encoded in a driver’s licence barcode, and retains gender and partial postal code along with identify and age, which contravenes PIPA’s provisions on restricted assortment and use of non-public data.”
“General, this investigation highlights two vital points,” mentioned Jill Clayton, Info and Privateness Commissioner.
“The primary is that it’s clear the legislature supposed the 2009 amendments to the GLCA to authorize licensed premises to gather some restricted private data for particular functions associated to investigating and in the end lowering crime.
“Nonetheless, the present language of the GLCA presents numerous sensible challenges, notably with regards to using ID-scanning applied sciences.
“I intend to follow-up with authorities and different stakeholders on this level to articulate these challenges and focus on potential options,” she mentioned.
Privateness discover insufficient
The OIPC investigation additionally discovered the privateness discover in Alcanna’s shops “was inaccurate and didn’t present sufficient contact data in case people have questions in regards to the assortment of their private data as required by PIPA.
“The privateness discover didn’t precisely determine the non-public data that’s collected or the needs for that assortment.”
Know-how not ‘accredited’ by OIPC
Clayton additionally identified that “acceptance of a privateness affect evaluation will not be a ‘seal of approval’ for advertising and marketing functions, notably when a know-how is applied in a brand new and completely different means in a special context.”
When Alcanna introduced it will be utilizing Patronscan know-how in January 2020, firm representatives mentioned it had been “accredited” by the OIPC, Thursday’s information launch mentioned.
“The OIPC, nonetheless, was not conscious of the pilot undertaking till it was introduced.
“The OIPC discovered that Servall relied on a 2009 privateness affect evaluation (PIA) overview of its know-how as proof that the know-how complied with PIPA, in addition to earlier investigations of the know-how applied in nightclubs.”
Nonetheless, years in the past, OIPC had instructed Servall: “The OIPC can not endorse and even approve Servall’s product as ‘privacy-compliant.’”
“This investigation serves as a reminder to all companies that the best way during which know-how is applied and what options are engaged, together with a number of different vital issues comparable to context, can have substantial implications for compliance,” Clayton mentioned.
“The findings from a overview by my workplace are solely as legitimate because the representations and data made accessible to us.”
© 2021 World Information, a division of Corus Leisure Inc.
