LETHBRIDGE, ALTA. -- Concerns are being raised over the privacy of COVID-19 contact tracing information being gathered at some Alberta restaurants and eating establishments.

Social media posts show lists containing names and phone numbers of dine-in customers being left unattended on countertops, in full view of other patrons.

"I think it’s fundamentally wrong," said Mike Hoffman, a member of We the People YQL, a group that has organized freedom rallies in Lethbridge.

Hoffman says he has a lot of concerns about restrictions being imposed during the pandemic, including an AHS directive that anyone who dines-in, now needs to sign-in.

Privacy concerns

"Until Alberta Health Services can prove to us that this is actually a worthwhile thing to do, I think they’re overstepping their boundaries of good taste by asking for your information."

More importantly said Hoffman, many establishments are not following rules under the Freedom of Information and Protection of Privacy Act.

"They are not protecting your personal information," added Hoffman.

In what he called a "little experiment" Hoffman and other members of the group visited several Lethbridge businesses, and found in some establishments contact tracing lists were left on the counter, unattended and in view of other customers.

In other cases clip boards are handed to customers to fill out at the table, while waiting for their order to arrive.

Hoffman said he took a picture of one list and called the individuals who signed it, to see if they realized their personal information had been breached.

"Those people were flabbergasted," he said.

Hoffman said women in particular may be concerned that people standing in the line behind them could access their name, phone number and in some cases, their address.

As far as the regulations go, Alberta Health Services said anyone who is served food or beverages while seated must provide contact information, including first and last name, phone number and date and time the person attended, before receiving service.

In a statement, AHS said "the food serving business is responsible for personal information in its custody, and must comply with the personal information protection act."

CTV reached out to the Office of the Information and Privacy Commissioner of Alberta, which says it’s the organization’s responsibility to protect personal information that it collects from customers.

"When collecting personal information as required for contact tracing purposes, an organization must take reasonable steps to ensure customer information is not in plain sight or cannot be easily accessed by others."

The Privacy Commission also provided the following guidance, when it comes to safeguarding information:

"Organizations subject to PIPA are required to make reasonable security arrangements to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction (section 34).

"Using a single customer sign-in sheet can disclose personal information about one customer to others.

"Organizations should consider how they can collect and retain the customer’s personal information in a manner that does not disclose it to others, and ensure that access to this information is strictly controlled by certain employees (e.g. not all employees have access to the information).

"We encourage anyone who sees customer lists exposed to raise the issue with the establishment politely, and refer them to our website for further guidance. If anyone has further concerns that their personal information has been collected, used or disclosed improperly by an organization, a complaint can be submitted to our office."

Hoffman maintains having multiple people handling the same clipboard and pen doesn’t seem like the most effective way to prevent the spread of COVID-19.

While some people have told him they are writing down false names and fake contact information Hoffman is urging people to refuse to sign the sheets.

"Just stand up for your rights and freedoms. Do not provide your personal information under the guise of health tracing."

Mike Hoffman

People should be prepared to face consequences if they take that advice.

When members of Hoffman’s group refused to provide contact information at one business the owner asked them to leave, and when they refused called police.

LPS said four people were served with a trespass ban that will be enforced should they attend the business again.