If you’re going into liquor or cannabis stores, it’s not uncommon to have to show identification.
But what about a fingerprint?
According to a recently released report, up to 30 privately-owned BC liquor and cannabis stores have been collecting private information that does not maintain adequate privacy management programs or document privacy policies, despite obligations under BC’s private sector Personal Information Protection Act (PIPA).
In some cases, liquor and cannabis retailers have been collecting private data using facial recognition software from customers and thumbprint identification from employees, among other biometrics, as well as personal data collection from their websites other than what is typically asked, like age, birthdate, identification.
All liquor and cannabis retailers collect personal information, though many initially believed they did not do so to such an extent, according to the report.
BC cannabis and liquor stores are not authorized to collect biometric information or “information about an identifiable individual”, including employee personal information.
PIPA requires organizations to notify individuals of the purpose of collection unless the purpose is obvious and the individual voluntarily provides their personal information for that purpose.
“While the purposes for the collection of personal information directly from customers, such as to make a purchase or to sign up for a newsletter, may be obvious and consent implied; the purposes for the collection of browser information or other online identifiers may not be obvious,” said the report.
“Web-based privacy policies are also an important part of ensuring the organization meets its obligations under PIPA in respect of personal information collected online.”
One concerning reason the report brought up was the fact cannabis is illegal in many jurisdictions outside of Canada. Some countries will deny entry to individuals who have purchased cannabis or work in the industry.
The province said that retailers who are considering any type of biometric collection will be scrutinized at a very high level.
The purposes for collection, use or disclosure of biometric information must be reasonable and express consent.
“Surprisingly, many retailers didn’t understand that they collect personal information, despite the fact that all private licensed liquor and cannabis retailers collect some form of personal information from employees and customers who enter physical stores or make purchases online,” said Michael McEvoy, BC’s information and privacy commissioner.
The report contained 18 recommendations for liquor and cannabis retailers to establish and maintain privacy management programs, including designating someone to be responsible for ensuring the organization complies with PIPA, developing written policies, and monitoring compliance and conducting risk assessments to know that security safeguards are effective.
This is a developing story.
Victoria Buzz has reached out for more information.
