Alberta Privacy Commissioner Finds Three Businesses Failed to Protect Information from the Reach of Identity Thieves

Following an investigation triggered by police discoveries of business and personal information under suspicious circumstances, the Alberta Office of the Information and Privacy Commissioner (OIPC) has found that three local businesses failed to protect personal information in their custody. Although the three businesses were themselves victimized, this did not affect their obligations to protect their customers' information under Alberta privacy legislation, the Personal Information Protection Act. Recommendations from the investigations by OPIC would require the three businesses to contact the individuals whose information was affected and may have been exposed to identity theft. Other recommendations required the organizations to take several additional steps, including limiting access to customers' personal information, providing privacy and security training for employees and, in one case, requiring the business to obtain computer equipment that will obscure credit card numbers printed on receipts and return slips. For the news release by OPIC and more information about the three cases, see: http://www.oipc.ab.ca/ims/client/upload/NR_P2005_IR_00123.pdf. Summary by: The Editor