Privacy commissioner finds Loblaw kept PC Optimum purchase histories after deletion
Loblaw Companies Ltd. contravened Canada's private sector privacy law by holding on to the purchase histories of PC Optimum members after their accounts were deleted and by taking too long to act on deletion requests, the Office of the Privacy Commissioner of Canada said on March 5.
The finding is one of the clearest statements yet from the federal regulator on what counts as anonymization. Stripping names and email addresses from a data set is not enough, the office said, if the remaining records could still be tied back to a person.
What the investigation found
The investigation, published as PIPEDA Findings #2026-001, began after six people complained that they could not delete their PC Optimum accounts and associated purchase histories and that Loblaw did not respond to their questions.
The commissioner found that Loblaw had a process for handling deletion requests but took an unreasonable amount of time to act on them, and that it failed to answer some privacy questions from customers. The office also found that Loblaw kept members' purchase histories after accounts were closed. Removing direct identifiers was an insufficient anonymization measure, and Loblaw did not show it had adequate controls to limit the risk of re-identification.
Under PIPEDA, personal information that is no longer needed must be destroyed, erased or made anonymous. When a company chooses anonymization, the burden is on the company to show the data has actually been anonymized. The office found Loblaw contravened principles 4.5.3 and 4.10 of the law, Law360 Canada reported.
Loblaw's response
Loblaw said it has changed its processes to respond to privacy requests on time and agreed to implement the commissioner's recommendations, including an independent third-party review of its anonymization process. "We remain committed to the continued responsible use of personal information," spokesperson Scott Bonikowsky said in an emailed statement reported by The Canadian Press.
Why it matters
Loyalty programs hold years of detailed shopping data. Purchase histories can reveal health conditions, religious practices, family circumstances and location patterns even without a name attached. The ruling signals to retailers, airlines and other loyalty program operators that keeping "anonymized" transaction data indefinitely carries legal risk unless they can prove it cannot be linked back to individuals.
The commissioner still cannot fine companies or issue binding orders under PIPEDA, which is why the office relies on commitments like the one Loblaw made.
What to do
- Organizations should test anonymized data sets for re-identification risk, not just remove names and contact details.
- Set and track service targets for responding to access and deletion requests.
- Consumers who want their loyalty data deleted should put the request in writing and keep a copy; unresolved complaints can go to the federal privacy commissioner.
