Hacker News Reader

Comment by y04nn | Hacker News Reader

So now, bar/restaurant owners can reliably track their customers: age/name, how often they come in each branch. Large franchise would also be able to track where and how often their customers travel and what they eat. I think this is real privacy issue. If you what to store the data, please anonymize it first, at least when it leaks it would be a lesser privacy disaster.

View on HN

In the EU, using this data to track customers would be illegal. That doesn't mean it can't happen, of course, but it should deter particularly large franchises from abusing this data.

In the US, bars often ask for photo ID to verify that customers are old enough to be served alcohol. That doesn't seem to lead to widespread customer tracking.

It seems it does: https://onezero.medium.com/id-at-the-door-meet-the-security-...

> bars often ask for photo ID to verify that customers are old enough to be served alcohol.

1. This is a subset of all customers so it is not as useful as all customers

2. I’ve never seen a bartender or waitress scan my photo ID or record the data on the ID; without that it isn’t highly unlikely the data is being stored.

Your comparison is just not valid.

There are some bars in Sacramento, CA that not only scan your ID, but scan your face, and use facial recognition to match you with previous scans, ostensibly to make sure you aren’t sharing an ID with someone underage.

It is extremely creepy.

time to avoid those bars. extreme oversight to ensure a 20-year-old doesn't drink. but hey at least the same 20-year-old can drive a car, vote for our public officials, and join the armed forces.

and buy a gun

Ever go to a cannabis shop in California? Your driver's license is scanned. I don't know about the facial recognition part, but it wouldn't surprise me.

Great! But I think we're talking about bars and restaurants.

Isn't it funny how shit like that is only reported from the USA? Here in the EU, the bartender looks with his eyes at the photo ID the teenage girl is holding up[1] and then pours her a drink.

But Yanks screech about European surveillance states, and denounce the evil EU and its "sheeple" citizens... Much better over there, of course, where it's just corporations and not the eevul gubmint that's doing it.

___

[1]: That she borrowed off her elder sister...

There's a gas station store that does this in Portland OR. They have a facial recognition camera at the door that scans each person to enter the store after sundown.

I have a lot of sympathy for people working late night in crime prone jobs.

why has this been downvoted so much? what's false about these two statements? Should he/she have added "in my experience"?

In my experience, both statements are accurate.

I don't get the downvotes here - these are two good observations.

Probably because it seems like personal experience. I can say most of the bars I go to check everyone’s ID, regardless of age. And there are a couple near me that scan IDs in to some system (allegedly so they can ban unruly customers.)

Surely this is down to regional variation. I go into bars all the time in Canada and no one ever IDs me.

I disagree with you. I have regularly had my ID scanned, in some bars systematically (all customers). Although only in the UK.

> In the US, bars often ask for photo ID to verify that customers are old enough to be served alcohol

If I saw the person pull out a notebook and write my information down I would physically take my ID back and walk away. I'm pretty sure most people would be put off by this action.

How about if they put it in a machine that verifies it as legit, but also just so happens to scan it in to a DB.

I've seen this exact setup before, in an entrance to a club, but no one seems to care.

I mean now we're getting into human psychology. You're right that people don't care as much but I'd argue that they don't really understand what is happening and how that data is used.

I'd wager that the vast majority of people think the machine only checks if the ID is valid and doesn't do anything else.

I would be put off by it as well, but good memory and cameras are harder to spot, so the lack of a notebook doesn't offer much protection.

Usage is explicitly limited by the EU law:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...

Article 10

Protection of personal data

1. Regulation (EU) 2016/679 shall apply to the processing of personal data carried out when implementing this Regulation.

2. For the purpose of this Regulation, the personal data contained in the certificates issued pursuant to this Regulation shall be processed only for the purpose of accessing and verifying the information included in the certificate in order to facilitate the exercise of the right of free movement within the Union during the COVID-19 pandemic. After the end of period of the application of this Regulation, no further processing shall occur.

3. The personal data included in the certificates referred to in Article 3(1) shall be processed by the competent authorities of the Member State of destination or transit, or by the cross-border passenger transport services operators required by national law to implement certain public health measures during the COVID-19 pandemic, only to verify and confirm the holder’s vaccination, test result or recovery. To that end, the personal data shall be limited to what is strictly necessary. The personal data accessed pursuant to this paragraph shall not be retained.

Thanks, it makes the limits of the processing much clearer and should stop some start-up to develop a custom QR code scanner/app that would generate some customers analytics.

Especially as technical details are widely available. https://sanipasse.fr/french-health-pass

Oh they're trying - I'm pretty well known person in the community, and the amount of "start-ups" and seedy "one man CEO" types there is.. overwhelming.

The system is actually comprised of two apps, CovPass and CovCheck.

Both are in the repo.

The check app validates the pass in-app, and, as far as I can tell, doesn’t phone home or report any data. IE there is no logging of the scanned persons data

And what prevents the checker from taking screenshots or recording the screen to harvest the data later?

The same thing that prevents them from stabbing you and taking your money. It's illegal and wrong.

It's illegal due to GDPR.

For one thing, GDPR. It's illegal.

Apps can also be configured to prohibit (or at least make it harder make) screenshots/screen-recordings. It can of course be circumvented, but still. It's illegal.

I would consider it as safe as showing my ID to a bartender/bouncer. Safer, even, as they don't get as much data.

Mah dude, they're already doing that from your credit card information.

If you want to store the data, don't, because it's a textbook example of illegal. And hopefully people will be paying close attention to what offered apps do.

But the chance of getting caught is next-to-zero, enfocement is very spotty when it comes to GDPR and I wouldn't be suprised if you could easilly sell that data to an off-shore company

Even if you care about this, it's only used during the current Covid restriction phase. In 1-2 years at the most* any investment in such a tracking scheme will be obsolete.

* Famous last words, I know

Then why specify a field in the format for "targeted diseases"?

An almost uncharacteristic case of reason and foresight. We are currently worried with Covid-19, but considering all the variants already present, lets just hope that there isn't a Covid-22. In any case, as soon as there are dedicated vaccinations against the variants, it is very likely that there is need for more fine-grained tracking. That is probably also the reason they include the vaccines used in the data set.

And even if we don't have the need to check for our vaccination state when going to restaurants soon enough, it would be good if those certificates could be used to track any other vaccination you get. Just as the replacement or digital alternative for the usual yellow vaccination booklet. It would make checking your vaccination status for your doctor much easier than trying to decipher what a colleague has scribbled many years ago.

This is meant for traveling. Countries like the Netherlands use Zero Knowlege proof based solutions for domestic use.

To exactly prevent this from happening.

large franchise can already do that with customer fidelity programs anyway...

They do, but you can opt out, here the check is mandatory, the same for paying by credit card, you can use cash.

GDPR Breach, plain and simple. No franchise would risk storing and leaking what amounts to medical records (since that is the source) in front of a GDPR Watchdog. Pretty sure you'd get the hammer if you did that.

Either way, the official apps that let you check the record do not allow tracking, only verification. The simple solution is that if you don't see them using the official app, simply leave.

> the official apps that let you check the record do not allow tracking, only verification.

So why are name and date of birth included in the QR code?

Because you need a way for the pub to authenticate that this is indeed your qr code (matching your id)

The EU standard was developed for the purposes of avoiding additional quarantine or testing during cross-border travel, not going to pubs within one’s own country. For domestic use of proof of COVID vaccination, some countries developed their own internal standards alongside the EU standard.

Not currently visiting pubs, I still wait until they stop validating their guests.

I don't think name and date of birth are enough for identity theft anywhere in Europe...

To check with your passport/id card that this is your QR code and not someone else’s…

To compare it with name and DOB in the government ID.

I would guess so that they can use more traditional ID (like a drivers license) to confirm the vaccine record is yours.

> The simple solution is that if you don't see them using the official app, simply leave.

It'd be easy to make something that looks like the official app but does store the information, especially if that app is open source (is it?).

That's beyond the point of GDPR, even if they collect the data illegally the value would be to reach the person (to give them promotional content, advertising, custom experience, what ever...)

Basically even if they collected the data they wouldn't be able to use it. If they just collected your name to personalize your experience they'd be literally in deep shit if someone asked: "where did you get this information from?" - which to you may sound a weird question, but since 2018, at least in my country, more and more people ask this question.

When in doubt, report. They'd need to show to authorities that the person gave explicit consent to store that data and to be used for personalized experiences.

It's about consent. If the user didn't give consent you have no use for the data, and you'll be storing toxic material to get you fined.

An app faking the official look would open you up to so many liabilities and the GDPR watchdogs will probably just drool at the thought of anyone trying to defend that in a court after getting hammered by record fines.

And what has been stopping malicious companies from doing this before? To enter bars in most European countries you are already required to show identification prior to entering.

> To enter bars in most European countries you are already required to show identification prior to entering.

this has never been a thing in any European country I've been in. Maybe if you look underage, but definitely not the norm.

Never happened to me. Never heard of this happening. Seems anecdotal and likely not widespread at all.

I have never been asked to show my ID at any bar in any country in the EU I travelled to.

You must have been to more European countries than I have...

(Twelve, I think.)

Absolutely not true unless you're a kid.

From a US perspective: 1) ID is usually not required but rather checked when is not clear and 2) it’s usually a visual check not a scan of the ID (though I know some bars do do this) so nothing is electronically captured.

Reply on news.ycombinator.com