Loblaws wanted too much information for $25 gift cards, privacy commissioner finds

Canada’s privacy commissioner has concluded that Loblaws initially requested too much personal information from some customers before they could collect their $25 gift card — offered to make up for the company’s role in a bread price-fixing scandal.

After a six-month investigation, the commissioner also ruled that because Loblaws later revised its request to clarify the precise data it needed from customers, the issue had been “resolved.”

The investigation followed complaints from Loblaws customers who objected to being asked to hand over sensitive personal data for a $25 gift card.

After the bread price-fixing scandal became public in December 2017, Loblaws offered the cards to customers in 2018. To collect, they had to fill in an online form providing details including their name and address.

While many people received their card in the mail without any additional steps, some were told they needed either to mail or send electronically a copy of their driver’s licence or a utility bill to Loblaws — or they wouldn’t get anything.

That sparked protests from affected customers, who got the ID request in March 2018.

“It was just like, ‘Oh hell, no, I’m not doing that,'” said Suzette Collins in Toronto who refused to comply.

10% affected

“Nobody should just be able to request your driver’s licence,” said Collins, who happens to work as a privacy and access-to-information consultant.

According to the privacy commissioner’s investigation, about 10 per cent of Loblaws’ gift card applicants received a request to send in ID — a step Loblaws took to weed out fraudulent claims.

The commissioner also said that on March 16, 2018, Loblaws revised its communications to customers to make clear that it was only seeking information that would confirm their name and address. The grocer also indicated on its website that customers could redact sensitive information — such as their photo or driver’s licence number — when they sent in ID.

“Loblaw took steps to limit the information it was collecting,” said the privacy commissioner’s report, which said it was “satisfied with those measures.”

Loblaws said it welcomed the privacy commissioner’s findings.

“The Loblaw Card program was designed to distribute many millions of dollars to our customers quickly and directly, with all the necessary privacy and anti-fraud safeguards,” said spokesperson Catherine Thomas.

Despite the resolution, some customers who refused to comply with the initial ID request never collected their $25 gift card, including Collins. She said she never received any follow-up communication from Loblaws explaining what information was actually required, or that she could redact details from her ID.

“They really don’t care,” she concludes.

A number of non-compliant customers did, however, eventually receive their $25 card — in July, 2018. At the time, the company told CBC News that it was able to validate their name and address through other measures including publicly available resources.

Where’s data going?

The privacy commissioner also investigated a complaint that Loblaws transferred sensitive personal information it collected from customers requesting cards to a third-party company in the U.S.

Loblaws’ privacy policy for its gift card program stated that personal data provided could be shared with three separate companies working with the grocer: prepaid card suppliers Blackhawk Network Canada, Peoples Trust Company, and U.S.-based legal administrative service company JND Legal Administration.

The privacy policy also stated that “personal information may be stored, accessed or used in a country outside of Canada,” including in the U.S. and El Salvador, where privacy laws may differ.

The privacy commissioner concluded that the complaint wasn’t “well-founded,” because limited information was shared with third parties and Loblaws was transparent about the process.