The Alberta Office of the Information and Privacy Commissioner ('OIPC') issued, on 7 October 2021, its results of its investigation to Alcanna Inc. in relation to its use of Servall Data Systems’ Patronscan ID-scanning technology in liquor stores. In particular, the OIPC outlined that it has issued 16 findings and five recommendations under the Personal Information Protection Act ('PIPA'). More specifically, the investigation determined that the ID-Scanning technology retained personal information including gender and partial postcodes, in addition to names and ages in contravention of Sections 11(2) and 16(2) of PIPA. Furthermore, the investigations concluded that the privacy notice in Alcanna's stores was inaccurate and did not provide adequate contact information in case individuals had questions in relation to how their information was being processed in violation of Section 13(2) of PIPA. In addition, the OIPC learned that Servall, the ID-Scanning company, had relied on a 2009 Privacy Impact Assessment review of its technology as evidence of PIPA compliance. Finally, the following recommendations were made: 

• Alcanna cease collecting personal information beyond those information elements specified by law;
• Alcanna modify the notices posted in its stores to meet requirements under Section 13(1) of PIPA;
• Alcanna develop and implement policies and procedures for the project system if it continues using it, or before it implements it in additional stores;
• Alcanna revise its contract with Servall to address the gaps highlighted in this report, including accountability for personal information collected, used, and disclosed as part of the project, and to clarify the roles of the parties; and
• Alcanna considers how long it needs to retain the personal information it collects in the project to reasonably meet its legal and business purposes and adjust its retention period accordingly.

You can read the press release here and read the results of the investigation here.