Privacy experts are raising concerns after a Winnipeg bar flagged a woman as a nationwide public safety concern through its ID scanning system, which led to her being denied entry to a Calgary Stampede venue in July.
Alexandra, a Montreal-based lawyer, went to the Riverside bar in St. Vital on June 6, where a person working security scanned her driver’s licence at the door using a Patronscan ID scanner.
She said she was not told why they were scanning it and had no idea an incident later that evening would lead to a flag that potentially banned her from bars across Canada.
“This flag had denied me entry at an establishment in a whole other province without my knowledge, without any transparency surrounding how this flag had been established,” Alexandra said.
She said she started feeling sick while at the Winnipeg bar and ran to the nearest washroom, thinking she was going to throw up. Someone knocked on the door and told her to leave, and Alexandra asked for more time to pull herself together. She then left without incident, she said.
CBC News is only using Alexandra’s first name because she fears professional repercussions by telling her story.
On July 9, she went to a venue at the Calgary Stampede that used the same kind of Patronscan scanner and was denied entry. The person using the scanner told Alexandra she had a “criminal record,” which she knew was false.
Assuming it was a fluke, Alexandra tried to get into the same venue the next day and was again denied, so she began asking more questions.
The venue worker showed her a flag in their system that was attached to her ID. The flag labelled her a “public safety concern” with a “serious” level of severity because she “went into the men’s bathroom and refused to leave,” noting the location was the Riverside.
“I quite quickly realized that this was data sharing because how would a flag from a bar in Winnipeg show up at this venue in Alberta?” Alexandra said.
She took a photo of the screen showing this information and shared it with CBC.
“I did find it to be quite outrageous,” she said of the specific flag. “There are people who go into bars and assault people and start fights, and do all sorts of horrible things.”
Alexandra soon learned the Winnipeg bar is part of Patronscan’s flag network, a system the Calgary-based platform uses to alert other venues about problematic people.
This eliminates having to call another bar to warn them of a problem patron or share incident reports with other venues, Patronscan’s website says. The system is used across North America and around the world. The idea is that it stops dangerous people from being allowed into venues.
The Riverside’s manager said in an emailed statement to CBC News that after Alexandra contacted the bar, it reviewed the matter and determined it was a mistake, saying it should have only been an internal flag. The bar has removed the external flag on her file, the manager wrote.
Lawyer labelled public safety concern after incident in Winnipeg bar
After her concerns, the bar reviewed its procedures with staff and how flags are entered and “when information should or should not be shared with other establishments,” the manager wrote.
The manager added the bar takes privacy concerns seriously but said there is an important distinction between the appropriate use of Patronscan for public safety and this “specific administrative error.”
Experts CBC spoke to said the incident raises multiple concerns related to how people’s personal information is used when their ID is scanned at an establishment.
Under federal private-sector privacy laws, an organization must inform individuals in a “meaningful way” of the purpose for collecting, using or disclosing someone’s personal information.
The law also states an organization must collect, use or disclose it for a purpose “that a reasonable person would consider are appropriate in the circumstances.”
Teresa Scassa, the University of Ottawa’s Canada Research Chair in Information Law and Policy, said people need to be asking questions when they are handing over their identification for scanning purposes.
“Is the collection necessary? Is it appropriate in the circumstances? Does it go too far? How is the data being treated? Is it secure? Who’s it being shared with? All of these questions come up,” she said.
A Patronscan spokesperson said in an emailed statement that when an ID is scanned, they collect the name, date of birth, gender, postal code and expiry date in order to verify someone’s age. If nothing happens that night, the record is deleted within 21 days in Manitoba.
If there is an incident, the spokesperson wrote, the venue can record a flag, and the information is held longer. For serious incidents, a network flag can be recorded. Those flags are visible to other Patronscan venues, but only when an ID is scanned.
In Vancouver, the BarWatch program has been running for over a decade, and its 46 bars and clubs all use Patronscan. It gives bars the ability to ban someone who is a gang member, or is deemed to be dangerous or harassing people, across the program.
BarWatch has policies for when someone is given a public flag and works with Vancouver police, said Curtis Robinson, the program’s chair and a former police officer.
Barwatch introduces lifetime bans for weapons infractions at Granville Street bars
Vancouver bars to dump unattended drinks after VPD warning
A strict code of conduct is posted that patrons must follow or risk getting banned through the system. British Columbia’s privacy commissioner gave the program the green light in 2009 on the agreement it would delete the information collected within 24 hours if there were no incidents.
“Individuals that are banned because of bad behaviour, we don’t take this lightly. You’ve basically acted in an unsafe manner, and you’re essentially told that, ‘Look, because of your behaviour, you can’t come in here or … go to any other BarWatch bar,'” Robinson said.
He says people who don’t want to have their ID scanned can choose to go to bars that don’t use BarWatch.
The entrance to the Riverside has a Patronscan sign, which is below eye level and posted under the machine that scans the identification. Alexandra said she did not see the sign when she was there.
The sign says that if someone is determined to be violent or otherwise “undesirable” from a safety perspective, their name, date of birth, gender, postal code and photo can be kept and shared with other Patronscan establishments.
Scassa said the sign raises several questions about whether this is adequate notice.
For example, she noted, it does not mention that specific incidents will be shared with other venues. In Alexandra’s case, the Calgary Stampede venue was able to see the incident involving her in the men’s washroom at the Winnipeg bar.
Scassa also said it does not state the data is held by a third party, and it is not clear how many establishments the information can be shared with or their geographic area.
Krystle Shore, an assistant professor at the University of Waterloo, studies the relationship between surveillance technologies to solve social problems. She said these sorts of notifications rely on people stopping, finding the fine print and understanding what it means.
“We get into grey areas when we are looking at a sign that’s posted at a bar, below a stand where somebody’s maybe not looking directly at it, as they’re walking in with 10 friends on a Friday night,” Shore said.
She said the Patronscan disclosure sign has a number of red flags — for example, the use of the word undesirable.
“What do we mean by undesirable? Undesirable to whom? And in what context?,” Shore said.
It is a system that relies on the subjectivity of one individual and can have real consequences, she said.
“And when we look at the surveillance of undesirables, there’s a long history of who in particular is being targeted by that framing,” Shore said, adding members of the 2SLGBTQ+ community have historically been labelled as “undesirables.”
The Patronscan spokesperson said the signage is mandatory for clients and has been updated as needed after various privacy commission reviews.
The company will open an investigation if a person disputes a flag, the spokesperson said.
Alexandra is in the process of making an official complaint to the Office of the Privacy Commissioner of Canada — an agent of Parliament that oversees the compliance of Canada’s privacy laws.
Ann Cavoukian, Ontario’s former privacy commissioner, described the incident as appalling and said it is something she sees as worthy of a commissioner investigating.
“This individual had no knowledge or awareness that this was taking place and that her information was going to be used in this manner afterwards,” she said.
Alexandra said she is telling her story so Canadians understand how their data can be collected and shared by third parties.
“In this world of increasing mass surveillance and use of AI to do these things, I think that someone needs to say something when they notice that their rights are being violated,” she said.
