Legal Commentary

Ruling says bar’s tactics over top

By David Canton

For the London Free Press  August 24, 2009

Read this on Canoe

PRIVACY: A patron complained after his driver’s licence was scanned and his photo taken before he was allowed into a Vancouver club

British Columbia Information and Privacy Commissioner David Loukidelis recently released a decision in response to a complaint by a customer of the Wild Coyote Club in Vancouver.

The customer complained about having his driver’s licence swiped and photo taken by a surveillance camera to gain entry to the bar.

The club’s system scanned and recorded the information found on the magnetic strip: driver’s licence number, name, sex, date of birth and partial postal code. The system tracks the date and time the customer entered, as well as the number of visits the customer makes to the bar.

Bar management said it used the information to: “improve customer safety, prevent minors from entering, keep a record of banned customers and keep a record of customers for use in court action or for law enforcement purposes.”

After receiving no “reasonable explanation” to inquiries concerning this practice, the customer filed a complaint with the Office of the Information and Privacy Commissioner for BC (OIPC).

B.C.’s Personal Information Protection Act (PIPA) governs the “collection, use and disclosure” of personal information.

Under Section 7(2) of the act, a business “must not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.”

Loukidelis found that the club’s actions breached this section, since the swiping, photographing and retaining the customer’s personal information was “not necessary” to achieve the purpose of public safety as stated by the establishment. Though obtaining such information may be “necessary” for certain customers who have been removed or barred in the past, it was not found to be necessary to collect such information from all patrons.

Further, despite the bar’s repeated claims that the practice had “dram-atically improved safety and security,” no material evidence was established to support this claim.

Instead, the privacy commissioner found, “There has actually been at least some increase in such events after the installation of the software. While improved reporting may account for some of the increase in incidents, the fact remains that Wild Coyote could not point to a single objective indicator to demonstrate improved safety as a result of the use of the system.”

Under Section 11 of the B.C. law, a business “may collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances.”

In this situation, Loukidelis found the collection of personal information was inappropriate. To protect the safety of patrons, information such as driver’s licence numbers is unhelpful. And collecting information from patrons who were never involved in any violent incident could not be justified.

In conclusion, Loukidelis held that while the issues of violence and public safety were real and deserving, the practices of the Wild Coyote Club breached the B.C. act. The club was ordered to stop collecting personal information and consult with the commissioner’s office if further measures were to be implemented.

Full post as published by eLegal Canton on August 24, 2009 (boomark / email).