Privacy advocates are expressing concerns following an incident where a woman was flagged as a potential public safety risk nationwide by a Winnipeg bar’s ID scanning system. This flagging led to her being denied entry to a Calgary Stampede venue in July.
The woman, identified as Alexandra, a lawyer based in Montreal, visited the Riverside bar in St. Vital on June 6. A security staff member scanned her driver’s license using a Patronscan ID scanner without explaining the reason for the scan. Little did she know that an incident that night would result in a flag being raised against her, potentially barring her from bars across Canada.
After feeling unwell at the Winnipeg bar and seeking refuge in the washroom, Alexandra was asked to leave by staff. She left without any issues. However, the incident triggered a flag in the system that later prevented her from entering a venue at the Calgary Stampede in July.
Upon being denied entry to the Calgary venue, Alexandra was informed that she had a “criminal record,” which she knew to be false. Subsequent attempts to enter the same venue were also unsuccessful. Upon inquiring further, she discovered a flag in the system labeling her as a “public safety concern” due to an incident in the men’s bathroom at the Riverside.
Alexandra was taken aback by the interconnectedness of the flag system, realizing that data sharing between the Winnipeg bar and the Calgary venue was at play. She shared her concerns with CBC, calling the situation “outrageous” given the severity of the flag.
The Winnipeg bar is part of Patronscan’s flag network, which alerts other venues about potential troublemakers without the need for direct communication. Following Alexandra’s complaint, the bar acknowledged the error, removed the external flag on her file, and reviewed its procedures regarding data sharing.
Experts highlighted the importance of transparency and informed consent when personal data is collected through ID scanning systems. Organizations must clearly communicate the purposes for collecting and using data, ensuring it aligns with privacy laws and individuals’ expectations.
Patronscan’s spokesperson clarified that data collected during ID scans is used to verify age and is deleted within 21 days if no incidents occur. However, serious incidents can result in long-term data retention and network flags visible to other Patronscan venues.
In Vancouver, the BarWatch program, which utilizes Patronscan, aims to enhance safety by sharing information on potentially dangerous individuals across its member establishments. The program enforces a strict code of conduct and collaborates with law enforcement to maintain a safe environment.
Critics raised concerns about the lack of clarity in Patronscan’s signage and the subjective nature of determining who is flagged as “undesirable.” They emphasized the need for individuals to be fully informed about how their data is used and shared by third parties.
Patronscan emphasized the mandatory display of signage at client establishments and committed to investigating flagged disputes. Alexandra is pursuing a formal complaint with the Office of the Privacy Commissioner of Canada to address the privacy breach she experienced.
Former privacy commissioners and experts called for scrutiny into the incident, emphasizing the importance of safeguarding individuals’ privacy rights and raising awareness about data collection practices. Alexandra hopes her story will prompt Canadians to be vigilant about their data privacy in an era of increasing surveillance and technology use.