Alberta's information and privacy commissioner has launched an investigation into a liquor store company's pilot project that requires government-ID scans before patrons can enter some of its stores.

"The investigation will determine whether the use of this technology is compliant with the Personal Information Protection Act, Alberta's private sector privacy law," the privacy commissioner's office said in a news release Thursday.

Critics have denounced the pilot project as a major encroachment on the public's privacy rights.

On Monday, liquor retailer Alcanna announced it is testing the new security program, in partnership with Edmonton police, to combat what both police and the provincial government have confirmed is a dramatic escalation in liquor store robberies over the past year.



At a news conference, Alcanna CEO James Burns said the company that developed the scanning system, Patronscan, has "been working with privacy offices in Alberta, Canada, across North America, to make sure this is all privacy compliant with both laws and norms of society."

But as CBC News first reported Wednesday, a spokesperson for commissioner Jill Clayton called that statement "misleading" and said the commissioner was strongly considering launching an investigation.

"There has been no consultation with our office on this project," Scott Sibbald wrote, adding the commissioner's office first heard of the project through media reports.

There is no set timeline for Clayton's investigation.

Patronscan says it dealt with commissioner previously

Neither Alcanna CEO James Burns nor vice president Joe Cook responded to interview requests from CBC News.

Alberio Bathory-Frota, the chief executive officer of Patronscan, said Thursday his company didn't consult the privacy commissioner's office before the pilot project because it has been employing the same technology in bars for more than a decade.

"We have been investigated by [the privacy commissioner] in the past and [were] found [to be] complying," Bathory-Frota said. He said the company last dealt with the commissioner's office in April 2016 when there was a public complaint involving the collection of personal information.

'"Every time we have gone through this process it has always been a very great process and the outcome has always been very positive," he said, adding that "we're going to communicate with [the privacy commissioner's office] and share everything that we can and be very transparent with them."



In a subsequent emailed statement, Bathory-Frota said: "Patronscan did not see the need to contact the office of the commissioner to use the same technology for simply a different type of venue.



"We are confident that the inquiry will conclude that all applications of Patronscan are designed to deter theft and prevent violent offences, and data collected from non-offending patrons is never sold to third parties or used for marketing purposes, and is deleted after 90 days."



Justice Minister Doug Schweitzer spoke at Monday's launch of the pilot project and stressed the need to immediately address the sharp spike in liquor store thefts. In an emailed statement Thursday, he said ID scanning is the liquor company's responsibility.

"Obviously, measures that do not comply with the law will not be part of any action the government may take," Schweitzer said. "That said, [Alberta Gaming, Liquor and Cannabis] confirmed that liquor licensees have successfully employed similar ID scanning measures for more than a decade."

Names, birthdates, postal codes

In 2008, privacy commissioner Frank Work ordered a Calgary nightclub to stop scanning patrons' driver's licences after a man filed a complaint. The nightclub and its parent company argued the scanning system was for their customers' safety and discouraged troublemakers from entering.

But in a ruling, Work said the company "did not provide any evidence to establish that collecting the complainant's driver's licence information, or that of other patrons, is in any way a deterrent to violent behaviour." He ordered the nightclub to cease the practice and destroy the information it had already collected.

Bathory-Frota said Patronscan stores a "limited subset" of information from each ID scan: name, date of birth, gender (if that information is on the card), and the first three letters of the patron's postal code. He said the company keeps this information for 90 days before it is permanently deleted from Patronscan's system.

At the project's launch Monday, Burns said Alcanna does not have access to this information.

"It is not accessed unless there is a crime, in which case law enforcement will have access to be able to try to see if that helps identify the perpetrator," he said.

If you have any information about this story, or information for another story, please contact us in confidence at cbcinvestigates@cbc.ca

Follow us on Twitter: @jennierussell_ @charlesrusnell