Canada’s privacy commissioner says Loblaw Co. collected an “excess amount” of personal information from customers when it offered $25 gift cards following its involvement in the bread price-fixing scandal.
The Office of the Privacy Commissioner of Canada (OPC) conducted an investigation into Loblaw’s conduct after a customer complained that the grocery retailer had collected unnecessary information for its Loblaw Card Program. The complainant also raised concerns about personal data being transferred to the United States and El Salvador. In 2018, Loblaw had offered a $25 gift card as a peace offering to customers after it admitted to participating in an industry-wide bread price-fixing scandal.
The OPC concluded that Loblaw had initially over-collected personal information from the Canadian customers looking for a $25 gift card, including driver’s licence numbers and photos.
“We are of the view that Loblaw should not have been collecting ID information beyond name and address, which were required for its purposes,” the OPC said in its report, which was released Wednesday.
The privacy commissioner also said that Loblaw failed to explain to customers that they could redact sensitive information, such as driver’s licence numbers, birthdates and digital photos, when they applied for a gift card.
Loblaw said it had asked for additional information, such as a utility bill of driver’s license, in certain situations, including multiple requests under a single name or single address. The company said the request for further authentication happened in 10 per cent of cases.
The OPC said Loblaw took steps to limit the information it was collecting during the investigation and that it was satisfied with those measures.
The privacy commissioner also found that Loblaw did not require additional consent to transfer data to the U.S. and El Salvador, and that it had been “sufficiently transparent” about the process.