this is actually so weird that..

so, who is collecting the data here? the business? or the health authorities?

i'm going to go with the health authorities, because this isn't a part of a commercial transaction.

so, to begin with, the law is forcing bar owners to do unpaid labour. as a basic point, if you're going to employ bar staff to fulfil a function, you should give them a paycheck for it. otherwise, they're working for you for free. you can't just order people to do unpaid labour because of an epidemic.

so, then, do we treat the bar staff as volunteers, or what? they have no employment obligation to collect the data. there's no court order involved. what is the basis of the authority, here?

so, i'm going to assume that we're dealing with the regulations as they apply to the government itself, which is actually provincial rather than federal. if we were dealing with the bar, it would be federal.....but that doesn't make sense, because the information isn't being used by the bar at all, let alone for commercial purposes. the relevant law is here:
https://www.ontario.ca/laws/statute/04p03

Records kept in other places
(2) A health care practitioner may keep a record of personal health information about an individual in a place other than the individual’s home and other than a place in the control of the practitioner if,

(a) the record is kept in a reasonable manner;

(b) the individual consents;

(c) the health care practitioner is permitted to keep the record in the place in accordance with a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 to that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998, if the health care practitioner is described in any of clauses (a) to (c) of the definition of “health care practitioner” in section 2; and

(d) the prescribed conditions, if any, are satisfied.  2004, c. 3, Sched. A, s. 14 (2).

these are pretty stringent requirements. what is consent, in context?

elements of consent
18 (1) If this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information by a health information custodian, the consent,

(a) must be a consent of the individual;

(b) must be knowledgeable;

(c) must relate to the information; and

(d) must not be obtained through deception or coercion.  2004, c. 3, Sched. A, s. 18 (1).

Implied consent
(2) Subject to subsection (3), a consent to the collection, use or disclosure of personal health information about an individual may be express or implied.  2004, c. 3, Sched. A, s. 18 (2).

Exception
(3) A consent to the disclosure of personal health information about an individual must be express, and not implied, if,

(a) a health information custodian makes the disclosure to a person that is not a health information custodian; or

(b) a health information custodian makes the disclosure to another health information custodian and the disclosure is not for the purposes of providing health care or assisting in providing health care.  2004, c. 3, Sched. A, s. 18 (3).

so, what that means is that the health authority is banned from asking the bar for your address unless you provide explicit consent for them to do so. even if you give the bar your number, if you deny consent to pass it on, it's the health authority that is breaking the law in asking for it.

under federal law, the bar can ask you for your number, but only for "valid commercial reasons". there's no exception for public health.
https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/

so, let's back up and count the ways that this is illegal.

1) it is illegal for the bar owner to collect information that is not for valid commercial reasons, and they have an obligation to ask you for consent, if they do. if you do not consent, they cannot collect.
2) it is illegal for the bar to share the data with the health authority.
3) it is illegal for the health authority to store data in a bar, or other random location.
4) it is illegal for the health authority to ask the bar to disclose the information.

i'm not citing the constitution; this is existing legislation.

can the mayor overrule the province?

not in canada. the mayor is just one voice on city council, and the city council only exists by statute. so, the premier can essentially walk into city hall and do whatever he wants. now, he shouldn't do that. but, we actually recently had a fight about this, and the city lost very badly. doug ford was actually able to go in there and redistrict toronto; that's not theoretical, he just did it and the court just upheld it.

the bylaw is meaningless.