Pandemic precautions make QR codes popular again, but privacy concerns remain

Photo: The Canadian Press

When Sasha Steinberg reopened Cider House after a COVID-19 shutdown last year, she erased the pub's list of about 50 ciders from a wall chalkboard and stopped printing hundreds of menus, instead placing pixelated, black and white squares on tables.

When scanned with a smartphone, the QR (Quick Response) codes generate a COVID-19 screening questionnaire, and guests who report no symptoms can then click through to the west Toronto pub's menu.

"It's worked like a dream," said Steinberg. In some ways it's an improvement, she said, since it reduces the grunt work associated with constantly cleaning menus and updating the chalkboard.

"I don't think that in the future we will go back to our regular menu."

Scores of other businesses have made similar moves, finding the solution cost effective and easy to use, as QR technology can link to websites, forms or apps. It's fast and often, free.

Dating back to the 1990s, QR code technology was originally developed for the automotive industry before disappearing. Thanks to the pandemic, they are now making a comeback, although data security and privacy concerns have emerged.

Saskatchewan removed QR codes from vaccination records last week after a privacy breach involving at least 19 codes displaying the wrong person's health info.

Weeks earlier, there were reports in Quebec that the QR codes had been stolen from vaccine passports belonging to legislature members.

Across the border, Florida attorney general Ashley Moody warned scammers can use the technology to reroute consumers to malicious websites.

"The risks are out there," said Imran Ahmad, a partner at Norton Rose Fulbright Canada LLP and co-head of the firm's data protection, privacy and cybersecurity practice.

"Hackers are always evolving. They're super sophisticated, they're going to find a way to reroute you to a site that may be malicious or a site that looks legit but actually has bad things happening in the background that are maybe unbeknownst to you."

He expects the implementation of vaccine passports in additional provinces and the introduction of such technology at more businesses to make privacy a hot topic.

The codes linking to web pages or apps made their debut in 1994, when Masahiro Hara, who worked for Toyota subsidiary Denso Wave, was asked by manufacturers to develop scanners that could read bar codes more quickly.

Denso Wave's website said bar codes could store only 20 alphabetical characters at the time and workers had to scan as many as 1,000 per day, making work less efficient and tracking vehicles and parts during manufacturing difficult.

It took Hara and a two-person team a year-and-a-half to develop the codes, which could be scanned 10 times faster than bar codes and ended up being used for inventory management and shipment tracking.

The codes eventually cropped up in other industries, but didn't become ubiquitous for consumers until the mid-2000s.

That was when smartphones became more commonly used, making users a target for marketers. Film distributors put QR codes on posters to link to movie trailers and BlackBerry promoted them as a way for users to quickly add each other as contacts on its messaging service.

But many smartphone users still didn't have internet or data on their phones and QR code reading technology wasn't as sophisticated as it is today, when all you need to do is aim your phone's camera at the icon.

The technology languished until pandemic measures created a perfect niche for its use.

Suddenly, people wanted to avoid handling objects such as menus, pens, forms or shared devices.

"I hardly used a QR code before the pandemic and now, not only am I using them, but I know how to use them very well," said Sylvain Charlebois, director of the Agrifoods Analytics Lab at Dalhousie University in Halifax.

A recent survey he conducted estimated three in five Canadians had used QR codes at a restaurant or grocery store in the previous month.

That means about 40 per cent of the country is not using QR codes, although Charlebois said that percentage is much lower among millennials and Gen Z.

He believes QR code usage will increase further because retailers and food businesses are increasingly seeing the wealth of data it can provide and its ease of use.

"You never know that you actually need something until you actually see it or use it well," he said.

However, he warns that companies and consumers should be careful because anyone can generate a QR code, raising cybersecurity concerns because some may use them to dupe or scam others.

"People are scanning everything and implying that things are safe, but if (QR codes) are going to get used more often, we're going to have to start thinking about authenticity," he said.

That's already on Steinberg's mind. At Cider House she keeps some paper menus sealed in a wipeable, plastic cover for guests who won't use QR codes or aren't savvy with a smartphone.

The menu and screening system she uses is from Canatrace, which says on its website that it complies with Canadian privacy legislation, only uses personal information in the event of a COVID-19 exposure and removes data from its system after 30 days.

Ahmad recommends businesses seeking a QR code service look for white papers verifying the provider's privacy policies, and inquire with other companies already using its products about their experience.

While he would be surprised to see restaurant QR codes used maliciously, customers who notice businesses like a bank using a QR code and feel it is out of the ordinary should call their branch and ask if the code is legitimate.

If you scan a code and it delivers malicious content or you have concerns after inputting information, he recommends reaching out to the Canadian Anti-Fraud Centre or a credit monitoring firm that can investigate abnormal activity in financial accounts.