Agreed with Rathji - although since it's a private business, they fall under the Personal Information Privacy Act (PIPA), instead of FOIP (which governs public sector).
http://pipa.alberta.ca/
He absolutely had no right to do this. I'd start with a call to the manager and if her concerns are not met with the manager, I'd escalate it with a complaint to the Privacy Commissioner for Alberta.