OPC Concludes Investigation into Authentication and Data Transfer Practices Used During Loblaw Gift Card Offering

On October 16, 2019, the Office of the Privacy Commissioner of Canada (OPC) concluded its investigation into Loblaw Co Ltd (Loblaw)’s authentication processes and data transfers related to their gift card program.  Loblaw’s gift card program was created in response to the retailer's admitted part in a bread price-fixing scandal.

In order to recover a $25 gift card, Loblaw required consumers to submit personal information including their names and addresses. Certain individuals were contacted and informed that they would not receive the gift card unless they provided additional information such as a utility bill or driver's licence. When questioned why this information was required, Loblaw clarified that this information was required to authenticate and verify name and address information. Loblaw also informed individuals that they could redact personal information which they did not wish to share.

The OPC held that Loblaw took sufficient steps to limit the personal information it was collecting. Additionally, the OPC investigated Loblaw’s transfer of personal information for processing to El Salvador and the US. The OPC found that, at the time the data was collected, Loblaw’s privacy policy indicated that personal information could be stored, accessed or used in a country outside of Canada. Therefore the OPC concluded that Loblaw was sufficiently transparent about its cross-border data transfer.

For more information, please see the OPC’s Report of Findings here.

Summary By: Juliette Sakran