“Appeal” to a private company to seek what’s effectively forced arbitration only ends one way en masse.
This sounds horrible. I hope there’s some legit privacy regulations passed to ban passive practices like this. Scanning an ID locally to check for duplicates that night sounds reasonable. Auto uploading it without notifying patrons to a central DB is not.