He's not suing, he's making a complaint to the Privacy Commissioner. There's a difference. Usually the Commissioner just looks at the situation, talks to both sides and tries to mediate a solution. Often time the worst that happens is a report is released with recommendations for change. Maybe the scanning practice will be okayed but must include some kind of explicit safeguards in accord with PIPA policy.
I disagree with you that the PIPA isn't a "good leg to stand on" in the case of a complaint to the Commission. In addition to the provision I cited below, there are a plethora of other requirements for compliance with PIPA that may be of concern here. Even if it is okay for Tantra and others to collect this information (which it very well may be) they have to conform with the Act with respect to how the info is collected, how it is retained and who it may be disclosed to. There are also issues with making the collection/retention policy available to those that inquire. Maybe all these policies are already in place and this whole issue is moot. If that were the case, though, then I would have assumed the Pennylane guy would have said that rather than essentially telling the paper that those who disagree with the scanning can fata off.
And the trou example is fine.
It's an example of something a private organization could ask of its potential customers that is completely irrelevant and would never stand any kind of scrutiny. Frisk searches and ID scanning are much more relevant to their intended purpose but I'm just taking your statement that "they can do whatever the hell they want" to an extreme to show you may be exaggerating a bit...