Alberta Privacy Commissioner Releases Report on Collection and Retention of Personal Information in Return-of-Goods Transactions

The Director the Alberta Office of the Information and Privacy Commissioner (Director) recently released her report on an investigation into the collection and retention of personal information by two Canadian Tire retail stores in Alberta. Complaints had been made that the two stores refused to complete return-of-goods transactions unless the customers provided their drivers' license information. The complainants alleged that their personal information was collected in contravention of Alberta's Personal Information Protection Act (PIPA). The Director considered whether the purpose of collecting drivers' license numbers was reasonable, as required under Section 11(1) of PIPA, and whether Sections 11(2) and 7(2) of PIPA had been breached. Section 11(2) provides that where an organization collects personal information, it may do so only to the extent that is reasonable for meeting the purposes for which the information is collected. In a related provision, section 7(2) provides that an organization shall not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information about an individual beyond what is necessary to provide the product or service. The stores contended that the collection of personal information is essential to determine whether or not the return is a fraudulent one because stolen merchandise is often returned to the stores fraudulently. However, the stores, as well as the Canadian Tire Dealers' Association, agreed that merely asking for a name, address and telephone number (not in itself sensitive information) and asking the individual to confirm identity with photo identification is sufficient to deter and detect fraud. The Director considered this to be recognition that collection and retention of driver's license numbers is not necessary for the business purpose of deterring fraud. Accordingly, its collection could not be reasonable for meeting the purpose for which it was collected and was therefore in breach of Section 11(2) of PIPA. Section 7(2) of PIPA was also breached because an organization cannot require a person to consent to collection of personal information that is not necessary. The Director further considered whether the retention of driver's license numbers contravened Section 35 of PIPA which requires organizations to limit the retention of personal information and to establish maximum periods of retention that meet legal and business needs. Since the driver's license numbers had been collected contrary to PIPA, the Director held that the organizations could not retain this personal information at all. However, the Director concluded that in some cases it was reasonable to request photo identification to confirm a person's identity. For a copy of the Director's Report, visit: http://www.gov.ab.ca/acn/200508/18529.pdf Summary by: Nicholas Wong