Canadian Privacy Commissioner Investigates Retailer’s Sale Of Refurbished Laptops Which Were Not Fully Wiped

On January 13, 2026,  the Office of the Privacy Commissioner of Canada (the OPC) released its findings of its investigation into Staples Canada ULC’s (Staples) privacy practices related to their “Openbox” program which allows customers to return laptops to be refurbished and resold by Staples. The OPC found that Staples failed to fully remove customers’ personal information from the returned laptops before resale.

Staples is a private Canadian retail sales company, operating more than 300 stores nationwide, selling electronic goods and office supplies, including laptops. The OPC’s investigation was initiated following a complaint from a former Staples employee under the Personal Information Protection and Electronics Documents Act (PIPEDA) alleging that Staples did not adequately safeguard or remove users’ personal information stored on laptops returned by customers and resold through Staples’ Openbox program.

The OPC identified several deficiencies in Staples’ policies, procedures, and employee training related to protecting personal information on returned laptops.

As a result of the investigation, the OPC recommended, and Staples agreed to implement, the following measures to bring itself into compliance with PIPEDA:

1. Develop and implement clear procedures and standards for wiping devices that are consistent with the device manufacturers’ guidelines for factory resets and data sanitization;
2. Improve training for employees responsible for wiping data from returned devices;
3. Ensure that all employees tasked with wiping devices complete training on this task before wiping devices; and
4. Arrange for an independent third party to conduct annual spot checks of returned devices in Staples stores that participate in the Openbox program once a year for a period of three years.

The OPC also outlined three reminders applicable to all organizations subject to PIPEDA that sell refurbished devices:

1. Full factory resets using the manufacturer’s instructions should be performed to adequately wipe personal information from electronic devices that are resold;
2. Organizations must develop and provide employees with clear, consistent, and standardized instructions for removing personal information from returned electronic devices; and
3. Organizations must train staff so that they can carry out technical tasks required to remove personal information from returned electronic devices.

The OPC’s full investigation report can be found here.

Summary By: Victoria Di Felice