Identification machines and video cameras in bars examined

PIPEDA Case Summary #2008-396

[Subsection 5(3); Principles 4.3, 4.3.1, 4.3.2, 4.4 and 4.5]

The patron entering a licensed establishment owned by Canad Inns was asked to show her driver’s licence, the cover of which was copied by an identification machine (ID machine). She did not mind showing her identification, but did not appreciate it being copied. At the time of the complaint, there was neither signage advising customers of this practice nor were there signs alerting patrons to the presence of video cameras inside the bar.

We looked at the issues of collecting personal information from bar and nightclub patrons via the ID machines and via video surveillance. We found that the ID machines were inappropriate for their stated purpose. We recommended that Canad Inns cease using them, and that the company remove all personal information already collected and retained by them, as well as the information collected and retained by the video cameras. Finally, the Office recommended that Canad Inns modify its signage to indicate that ID checking must take place at all of the establishment’s entrances (including VIP entrances).

The company followed the recommendation to modify its signage and agreed to limit the retention of information recorded on video to a maximum of 30 days. Canad Inns also agreed to provide, on request, access to an individual’s own information (i.e. video images), and that any identifiable images of other individuals be blurred from the recording.

Finally, Canad Inns responded that it did not agree with the recommendations to cease using the ID machines and to remove the personal information already collected by them.

Ultimately, the Assistant Privacy Commissioner concluded that the complaints were well-founded but partially unresolved.

The following is an overview of the investigation and the Assistant Commissioner’s deliberations.

Summary of Investigation

Upon entering a beverage room owned and operated by the Canad Inns hotel chain in Brandon, Manitoba, the complainant was asked to produce identification, which was then placed into a machine that photocopied and retained the information appearing on her ID card. The complainant objected to this practice and felt that customers should be advised beforehand that their identification information will be copied and kept. When she complained to the management, she was told that provincial liquor control regulations require recordkeeping of who is in the facility.

Canad Inns operates a number of hotels within the province of Manitoba. These hotels contain different licensed establishments and, under these licenses, only persons 18 years or older may be served alcoholic beverages, as subject to The Liquor Control Act of Manitoba.

ID machines were introduced by the company approximately 10 years ago, but they are not used in all of its licensed premises, nor does video surveillance occur in all of the company’s licensed premises. At premises where there is video taping, there is no signage to indicate that this type of surveillance occurs. (The complainant also objected to the videotaping of customers.)

Collection and retention of ID card information

Canad Inns had a policy whereby security personnel located at the entrances of its licensed premises copied the “relevant portions” of valid photo IDs of patrons into an ID machine. Although the company policy stated that only the individual’s name, photograph and birth date were essential, the policy also stated that due to the ID machine’s technical limitations and the different configurations of the various ID cards accepted, it was possible that non-essential information from an ID card could be copied.

We reviewed The Liquor Control Act of Manitoba, which sets out licensed establishments’ obligations in verifying the identity of their patrons and maintaining their safety. The legislation states that the driver’s licence is one of several types of acceptable identification for these purposes. But it does not oblige the management to keep a copy of a patron’s ID.

The information from the ID cards is kept by Canad Inns for 31 days, but sometimes longer if a particular incident occurs inside or directly outside the beverage room.

Canad Inns contended that it uses ID machines not only for the purpose of age verification, but also as part of a comprehensive security system. It could not provide supporting information on the number of charges ever brought against it (i.e. for the serving of alcohol to minors), either before or after the introduction of the ID machines. In fact, the company conceded that there may not have been any charges filed against it at any time for this infraction.

A review of information we obtained from the provincial liquor control commission revealed that Canad Inns had been cited for three licence infractions of this type under The Liquor Control Act of Manitoba during the previous 15 years. Of the three, one occurred before the ID machine system was in place and two occurred afterwards. We noted that the Canad Inns establishment in Brandon was not involved in any of these infractions.

Another concern we had was the lack of consistency in ID verification and copying. Although the company had stated that the ID information of all customers was collected, the investigation learned that VIP members, who purchase a VIP membership that waives cover charges and allows holders to avoid line-ups at regular entrance points, were not generally checked.

Collection of information by video surveillance

The video cameras are trained on the entrances and exits for security purposes, and capture activity taking place at these points. The information is retained on tape for 31 days.

When questioned about the security purpose of the cameras, Canad Inns indicated that it was difficult to measure improved security. Although the company stated that the likelihood of being videotaped might deter those who might otherwise cause trouble, it was unable to provide supporting statistics to show a decrease in bar incidents since the introduction of the ID machines or video surveillance.

Law enforcement perspective

When queried, the police services in two cities where Canad Inns operates generally endorsed the use of ID machines in licensed establishments, but could not provide us with any statistics showing that use of the machines and/or video surveillance are associated with fewer problems in bars. Both police services were of the view that such measures encourage customer accountability and improve safety. One police service noted that both measures had been instrumental in identifying people involved in criminal offences at licensed establishments, offences that included two homicides and a kidnapping.

Findings

Issued February 27, 2008

Application: Subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Under Principle 4.3, the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.1 states that consent is required for the collection of personal information and the subsequent use or disclosure of this information. Typically, an organization will seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use (for example, when an organization wants to use information for a purpose not previously identified).

Principle 4.3.2 stresses knowledge and consent. Organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

Principle 4.4 states that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Principle 4.5 stipulates that personal information shall be retained only as long as necessary for the fulfillment of those purposes.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• At the time of the complaint, there was no signage in the establishment visited by the complainant informing customers of the collection and retention of identification via the ID machines. The complainant’s personal information was therefore collected without her knowledge or consent, in contravention of Principles 4.3, 4.3.1 and 4.3.2. It was noted that this situation was later rectified: signage was added, which stated, “Photo ID recorded upon entry. Information recorded and retained will only be used for security purposes”.
• However, the underlying question to be addressed was whether the purpose of the collection was acceptable under the Act. The intent of the Act is to balance the individual’s right to privacy against the need of an organization to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. While an organization may be properly informing customers of a collection of their personal information and seeking their consent, the underlying purpose of the collection may still be questionable. For example, the complainant in the present case specifically noted that even if she been made aware of the company’s intent to scan and keep a copy of her photo ID, she would not have granted consent and would have withheld her identification. For her, the justification and purpose of the collection were unclear.
• The company maintains that the purpose for using the ID machine is twofold: age verification and security. However, it was not clear to the Assistant Commissioner how the machine verified age. When a patron enters the bar, an employee–not the machine–compares the patron’s face to the photograph on the ID card and checks the listed birth date. The ID machine merely records the information.
• The Assistant Commissioner noted that the information is kept for 31 days–longer than necessary to verify a patron’s age–and that the bar did not need the driver’s licence number nor the facial image to meet its purposes, thus contravening Principles 4.5 and 4.4, respectively.
• Certainly the legal obligation that patrons meet the minimum age requirement must be respected. However, provincial legislation in Manitoba does not require bars to collect (i.e. record) and retain photo identification. An equally effective and far less privacy-invasive means of ensuring age compliance is to have staff look at the identification and verify the age and identity of individuals entering the premises.
• Regarding the second stated purpose for using the ID machines (i.e. security) the Assistant Commissioner understood the reasons for ensuring the security of patrons and staff, but did not consider the machines capable of fulfilling this role. Deterrence appears to be an inherent element in the security purpose–namely, the idea that troublesome individuals are less likely to try to enter the beverage room if they know that the identification they present is being recorded. The Assistant Commissioner noted that, while this is certainly possible, there was no way of knowing whether this has ever occurred, and the company could not provide any statistics to support such a hypothesis. Moreover, she noted, identification of VIP members is not usually scanned, so a certain proportion of the clientele would be systematically eliminated from any statistical analysis. Without any evidence to support the claim, it was unclear to the Assistant Commissioner how the ID machines were effective in meeting the need for security.
• The stated purposes of the ID machine (age verification and security) did not therefore meet the requirements of subsection 5(3) of the Act.
• Regarding the collection of personal information by means of video surveillance, Canad Inns asserted that the cameras provide additional security for the establishment. The Assistant Commissioner had no difficulty in recognizing that in any establishment where individuals consume alcohol, security issues can arise. The cameras could indeed enhance security and, if a recording captures criminal activity, the tape could aid any subsequent attempt to prosecute.
• The cameras in the premises were trained on access areas (e.g. entrances and exits), and did not cover areas such as the bars, dance floors or the VIP area. In the absence of any real evidence offered by Canad Inns showing the effectiveness of cameras to improve security, the Assistant Commissioner deliberated that if the goal was in reality to enhance security, would it not make sense to point cameras toward areas of the bar where there were usually fewer people? Since security staff could be as effective a deterrent to security incidents as video cameras, focussing cameras on high-traffic entrances and exits (the locus of security personnel who are specifically trained to deal with trouble) is effectively doubling the coverage of these areas and leaving other areas entirely unprotected. If a staff member were able to monitor the cameras surveying the isolated areas of the bar, assistance could then be provided if ever needed. In more popular areas (i.e. not under video surveillance), security staff and patrons could alert each other of any security incidents occurring there, and later act as potential witnesses, if required.
• Therefore, the Assistant Commissioner agreed that the purposes for the cameras were legitimate, and were therefore in keeping with subsection 5(3). However, she questioned whether the cameras were in fact meeting this purpose, given their positioning at the time.

Recommended Actions and Canad Inns’ Response:

• We recommended that Canad Inns undertake the following actions:
  • That the company cease collecting and retaining personal information via the ID machines and move its video cameras to areas where there are typically fewer security staff present;
  • That the company modify its signage to indicate that identification must be produced and will be verified in all instances (including at VIP entry points);
  • That the company remove all the collected personal information of customers from its video surveillance cameras and from ID machine storage units.
• Following the recommendations, Canad Inns added the appropriate signage in all the recommended locations.
• Canad Inns agreed to limit retention of the information recorded on the videotapes for no longer than 30 days.
• Regarding their placement, the Assistant Commissioner accepted the placement of the video surveillance cameras. Canad Inns agreed that when individuals request access to their personal information (e.g. their video image), they would be allowed access to it. Moreover, for such a request to be met, the images of any other individuals captured in the video will have to be pixelated or otherwise obscured so the other individuals cannot be identified.
• However, Canad Inns responded that it did not agree with the recommendation to cease collection and retention of personal information by means of the ID machines. It is the Assistant Commissioner’s view that while client and staff safety and security may be legitimate needs in the beverage service industry, the company did not provide evidence of a correlation between patron safety and the collection of personal information via ID machines. The verification of a client’s age does not justify the collection and retention of all other personal information contained on a driver’s licence (or any other similar ID card).
• Finally, Canad Inns failed to follow up on the recommendation to remove all personal information that had already been collected and stored by the identification machines.

Accordingly, the Assistant Commissioner concluded that the complaint was well-founded but partially unresolved, specifically with respect to the recommendations made to cease the collection and retention of personal information via ID machines, and to remove from ID machine storage units the personal information already collected.

Update

The Privacy Commissioner of Canada has reached a settlement with the Canad Corporation of Manitoba Ltd (Canad Inns).