Privacy advocates are expressing concerns following an incident where a woman was flagged as a potential public safety risk through an ID scanning system at a Winnipeg bar, resulting in her being denied entry to a venue at the Calgary Stampede in July.
The woman, identified as Alexandra, a lawyer based in Montreal, visited the Riverside bar in St. Vital on June 6. During her visit, her driver’s license was scanned by security using a Patronscan ID scanner without explanation. Unaware at the time, this scanning incident later triggered a flag that prevented her from accessing bars nationwide.
Upon feeling unwell at the Winnipeg bar, Alexandra sought refuge in the washroom and was eventually asked to leave, which she did without causing any issues. Subsequently, on July 9, when she attempted entry to a Calgary Stampede venue utilizing a similar Patronscan system, she was informed that she had a “criminal record,” an assertion she knew to be untrue.
After being denied entry on two separate occasions, Alexandra inquired further and was shown a flag in the system labeling her as a “public safety concern” due to an incident where she allegedly entered the men’s restroom at the Riverside and refused to depart.
Subsequent investigations revealed that the Winnipeg bar participated in Patronscan’s flag network, a mechanism used to alert other venues about problematic individuals, aiming to prevent potentially dangerous persons from entering their premises.
Following Alexandra’s complaints and subsequent review, the Riverside bar acknowledged an error in flagging her and removed the external flag from her file, emphasizing the importance of distinguishing between appropriate public safety measures and administrative oversights.
Experts highlighted the need for transparency and informed consent when personal data is collected through ID scanning systems. Under privacy laws, organizations must clearly communicate the purpose of collecting personal information and ensure its use aligns with what a reasonable person would consider appropriate.
Patronscan clarified that data collected during ID scans is utilized to verify age and is deleted within 21 days if no incidents occur. However, for serious infractions, flags can be recorded and shared among Patronscan venues only upon subsequent ID scans.
In Vancouver, the BarWatch program, which employs Patronscan across 46 bars and clubs, focuses on banning individuals engaging in unsafe or disruptive behavior. The program operates under strict guidelines and collaborates with law enforcement to maintain public safety.
Critics raise concerns about the adequacy of notification regarding data sharing practices, emphasizing the importance of individuals being fully informed about how their information is utilized and shared by third parties. Additionally, they stress the need to consider the potential consequences of subjective data labeling and the historical implications of such practices on marginalized communities.
Patronscan asserts that mandatory signage is in place at establishments using their system and ensures a process for investigating and resolving disputes over flagged information. The affected individual, Alexandra, is pursuing an official complaint with the Office of the Privacy Commissioner of Canada, seeking accountability and transparency in data handling practices.
In light of the incident, advocates stress the significance of understanding data privacy and advocating for individual rights in an era of increasing surveillance and technological advancements. Alexandra aims to raise awareness about data collection and sharing practices to empower individuals to safeguard their privacy rights in an evolving digital landscape.
