That was just my personal opinion, I haven't looked up law on it so I could be wrong. Obviously if the law says they can't then no policy they have saying they can is enforceable. I don't like unseen, heavily biased adherence contracts. In that case, walk away from the security guy with impunity.