Alberta Orders Home Depot to Stop Collecting Driver's License Information

Two days after she purchased goods from Home Depot of Canada Inc (Home Depot) using her debit card, a complainant (Customer) brought the goods back to obtain a refund. The Customer produced the receipt but did not have her debit card with her and, as a result, the Home Depot employee refused to process the return of the goods unless the Customer provided her driver's license for entry in the company's computer system. The computer system was controlled by Home Depot's head office located in the United States. Failing the production of the driver's license, the return would be treated as a return without a receipt and the Customer would not receive a full refund. The Customer filed a complaint with the Alberta Privacy Commissioner (Commissioner) over Home Depot's collection, use and disclosure of personal information to its head office in the United States. Home Depot asserted that the purpose of collecting this personal information was to prevent fraud, since the failure to produce a debit card was an indicator of fraud. However, if the price of the item was confirmed, Home Depot permitted a full refund without the collection of a driver's license information. The Commissioner referred to a previous joint report with the Federal Privacy Commissioner in which they found that the collection of driver's license information for the purpose of preventing fraudulent returns was excessive, and that the reasonable collection of personal information was limited to a customer's name and address (see ETIPS®, "Federal Privacy Commissioner Reports on TJX Data Breach as its Extent Grows" Vol 6, No 10, November 7, 2007). Accordingly, the Commissioner found that Home Depot's collection and disclosure of the driver's license information in a database was unnecessary and ordered Home Depot to cease collecting such information for processing full refunds. For the text of the Alberta Privacy Commissioner's decision (Order P-2007-016, March 20, 2008), see: http://www.oipc.ab.ca/ims/client/upload/P2007-016.pdf Summary by: Lauren Lodenquai