See how this ID scanner could blacklist you from local bars
Susan Durst, the manager of The Press Club bar in downtown Sacramento, said she was walking past the bar’s ATM last month when a man reached out and groped her.
After talking to security, she went to the bar’s PatronScan kiosk, sifted through photos of customers that night and banned her assaulter for the next year — not just at The Press Club, but everywhere else in town that uses the technology. The customer joined a blacklist of more than 1,000 people who have been banned from a network of Sacramento bars.
“Hopefully no one else is going to be accosted by that person,” said Durst, who’s worked at The Press Club for 16 years. “We’re all in same club down here, we all should be working together, and if we can keep each other safe, that really means a lot.”
The Press Club used to warn neighboring bars of problem customers using a phone tree. That was before buying a PatronScan kiosk in November.
Now, The Press Club has joined a growing list of Sacramento bars linked up using the controversial ID kiosks. Amid a national debate about the mass collection of personal information, the ability of bar owners and bouncers to create a blacklist that stretches across the city and the country is worrying privacy advocates.
Supporters say PatronScan — used at roughly 30 Sacramento bars — is a high-tech, coordinated way to exclude bad actors from the city’s nightlife. But privacy experts worry that retaining thousands of unsuspecting customers’ personal information is a gross invasion of privacy, and claim the company’s digital blacklist actually threatens some of those same people’s well-being.
PatronScan has assisted in more than 50 criminal investigations at local bars in the last three years, police say. It’s also the basis for a new state law authored by a career law enforcement officer who says the company’s data collection and storage invades people’s privacy. The system is required for nearly half of Sacramento businesses with alcohol and live music.
In 2016, the city of Sacramento began – on a case-by-case basis – requiring some businesses with ABC licenses to obtain ID-scanning technology before they could receive entertainment permits, which expire every two years. Canada-based Servall Biometrics produces PatronScan, the field’s leading company and the one most commonly used in Sacramento.
PatronScan’s scanning software confirms IDs are state-issued and haven’t already been scanned that night, while an attached camera photographs each customer. Police investigating a possible crime can ask a bar for names and faces of all customers on a given night in their search for witnesses and suspects.
Bar managers can also “flag” problem customers upon request from their staff, effectively banning that ID. A “private flag” needs no reason and can result in up to five years suspension from that one bar; a “public flag” for incidents such as fighting, sexual assault, drug use or using a fake ID can result in a five-year forced hiatus from all bars that use PatronScan technology in the U.S., Canada, Australia and the United Kingdom.
PatronScan declined to provide a list of Sacramento bars that use its kiosks. A May 2018 report shared with California legislators, however, identified the following bars: Ace of Spades, Badlands, Chaise Lounge, Chando’s Cantina, Coin-Op Game Room, District 30, Dive Bar, El Rey, Faces Nightclub, Harlow’s and Momo Lounge, Hookaholics Hookah Lounge, Knobs & Knockers, LowBrau, Malt & Mash, Mangos, Mix Downtown, Punch Bowl Social, Republic Bar, Sky KTV, Social Nightclub, The Park Ultra Lounge and Vanguard 1415.
El Rey, Knobs & Knockers and Vanguard 1415 have since closed, while a handful of other bars including Highwater, Midtown Barfly, The Flamingo House and The Press Club have started scanning customers.
Assemblyman Jim Cooper, D-Elk Grove, first ran into PatronScan at Coin-Op Game Room in late 2017, he said. A former undercover detective with a 30-year career in law enforcement, Cooper had just finished a two-year stint on the Assembly’s Committee on Privacy and Consumer Protection.
Cooper felt uncomfortable with having his ID scanned, he said. So uncomfortable that he authored AB 2769, which severely curbed what data PatronScan and similar companies could keep. Opposed by the city of Sacramento and PatronScan, it was nonetheless signed it into law last September.
“Why should anyone care or know where you’ve gone?” Cooper said. “That’s your right as a private person to go where you want and not have it recorded somewhere. That doesn’t make any sense whatsoever.”
As a result of Cooper’s bill, ID-scanning companies also lost their legal ability to store data on California customers. PatronScan, however, merely scaled back its reach.
Bars on the PatronScan network were previously able to hand out lifetime bans and did so with some regularity. More than 1,100 Sacramento customers were blacklisted with an average ban of 19 years as of the May 2018 report. All bans are now retroactively subject to California’s five-year maximum, a PatronScan spokesperson said.
Non-offending customers’ information is now kept for 30 days, down from 90 but still against the letter of Cooper’s law, he said. PatronScan also discontinued daily marketing reports to California clients that included total customers, number of first-time customers, age, birthdays that night, gender split and median income for each ID’s zip code, a spokesman said. Bars in other states still receive those reports.
“What’s this being used for? Is it really being used to verify ID, or to harvest data? I think for PatronScan, it was to harvest data,” Cooper said. “I see a beneficial use for PatronScan (technology), but not in the way it’s being used by that company.”
Though Cooper supports some data retention for a short window to aid in police investigation, he said he’s now looking into possible repercussions for the company’s alleged AB 2769 violations.
Police investigate incidents the night they happen or day after, said Sgt. Kristi Morse of the Sacramento Police Department’s entertainment team, and therefore have no opinion on whether a customer log is kept for 30 or 90 days. Cops generally support ID scans because of their potential role in solving crimes or keeping them from happening, Morse said.
“It’s hard to measure, but ... I think PatronScan gives (customers) a sense of personal accountability,” she said. “People feel like they can’t just do whatever and take off. They have some ownership of how they behave inside an establishment.”
PatronScan maintains that storing information on California bar-hoppers for those 30 days is legal (the 90-day policy hasn’t changed outside the state). Servall Biometrics CEO Alberio Bathory-Frota didn’t expand on how in an email, other than to say the company had consulted “one of the top privacy lawyers in the country.” Customers can request a list of what bars they’ve visited in the last 30 days at https://www.patronscan.com/disclosure-request/.
“PatronScan works hard to engage in pro-privacy practices by collecting the minimum amount of information needed to identify perpetrators of violent behavior and unless a patron is flagged, their data permanently deleted within 30 days,” Bathory-Frota wrote in an email. “PatronScan does not sell or give away patron information, period.”
The power handed to bar owners, however, worries immigration activists. Being slapped with a criminal label after limited due process could have repercussions beyond denied entry to bars, said Christopher Sanchez, a Sacramento-based policy advocate at the Coalition for Humane Immigrant Rights of Los Angeles.
As U.S. Immigration and Customs Enforcement deportation efforts remain high, the more than 1 million undocumented immigrants with California driver’s licenses should be concerned about a possible PatronScan data breach — or that the company could willingly share their ID information with law enforcement, Sanchez said.
“Under this (presidential) administration, we don’t want to take any risks,” Sanchez said. “Given (ICE’s) tactics, we know that they’re really looking for folks they can get their hands on and have easy access to ... they basically make all individuals a priority.”
Though PatronScan allows customers to appeal their bans within 10 days of the incident, many don’t know they’ve been blacklisted until they next visit a bar on the network.
The good news? With more 10,000 IDs scanned in Sacramento a given night, per the report, odds are many people won’t have to wait long to find out.
Correction: Some businesses that apply for the city’s entertainment permits are required to obtain ID-scanning technology. A previous version of this article, which appeared in Friday’s print edition, indicated that all businesses applying for the permits were mandated to do so; the city of Sacramento requires some, not all bars to do so. Additionally, the article incorrectly said PatronScan facial recognition software can identify people outside the bar who have previously had their IDs swiped as well as what drink they might order. That technology belongs to one of PatronScan’s competitors, IDScan.