Canada’s Privacy Commissioner has launched an investigation into Loblaw Cos. Ltd. after receiving numerous complaints from customers about the information they are being requested to provide to claim $ 25 cards being issued by the grocer as partial compensation for 14 years of bread price-fixing.
“We have reached out to Loblaws following media reports about authentication practices related to the issuing of bread price-fixing gift cards. In the meantime we have received numerous inquiries to our Information Centre and through our Twitter feed. In the wake of a formal complaint to our office, we have now opened an investigation,” according to Tobi Cohen, a spokesperson for the Office of the Privacy Commissioner of Canada.
The commissioner will look at whether Loblaw violated a federal act protecting the privacy of Canadians when it asked some customers to send a copy of a utility bill or their driver’s licence via email or post in order to claim the $ 25 card.
Loblaw slammed over personal information requests in gift card rollout
The commissioner cannot impose fines for contraventions but the Federal Court has the power to award damages to a complainant, according to information from the Privacy Commissioner.
Kevin Groh, a spokesperson for Loblaw, said that the company is trying to avoid paying fraudulent claims.
“Our plan to distribute tens of millions of dollars is a natural target for fraudsters, and we want to make sure this money is actually landing in our customers’ hands,” Groh said.
Oakville resident Karen Wong was one of the customers rankled by the request.
After applying for one of the $ 25 cards, she received an email from Loblaw asking her to submit a scanned copy or a photo of either a current utility bill or a valid driver’s licence through what the company described as a secure portal. The email offered her the option of mailing the information to a Vancouver address.
“We need this information within 30 days so that we can finish processing your registration. Your utility bill or driver’s licence will not be used for any purpose other than to verify your eligibility to receive a $ 25 Loblaw Card and will be destroyed as soon as the verification is complete. If we do not receive this information within 30 days, we will have to reject your registration without further notice,” read the email from Loblaw.
Wong took issue with the tone of the letter, pointing out that she has lived at the same address for many years and that Loblaw could have used a less compromising approach to confirm that fact, for example by looking up her address up online or by calling her. She is also concerned about protecting her personal information, despite the assurances from Loblaw.
“Loblaw says they have secure measures to destroy the information. We are all aware that people hack systems,” said Wong, adding that her sister, who also lives in Oakville, was not asked to provide additional information.
Groh said the driver’s licence is “not required.”
“A utility bill will do, as it confirms the information already provided — specifically, their name and address,” said Groh.
He reiterated that ID will be collected through a secure channel, verified and then destroyed.
“This program is designed to pay people back quickly and directly, without requiring proof of purchase or forcing customers to wait for a class-action lawsuit,” Groh wrote in a statement.
“Millions of dollars of Loblaw cards have already been received and spent by customers. For a small percentage, we’ve asked for proof of name and address. A utility bill — which simply confirms name and address — will do. ID will be collected through a secure channel, verified, then destroyed.”
According to information posted to the privacy commissioner’s website, retailers need to exercise restraint when asking customers for their driver’s licences.
“A driver’s licence is not a universal identity card. Rather, it is a means to enforce traffic laws and offer proof that someone is authorized to operate a motor vehicle. The driver’s licence number is sensitive and valuable to those intent on committing identity crimes. For this reason, these numbers are often the subject of security attacks and misuse,” according to the website.
Retailers’ personal-information practices are governed by Canadian law. “Essentially, these laws require retailers to clearly tell customers why they are collecting the information and then ask for the least amount to meet their purposes,” according to the commissioner’s website.
“They also demand retailers to protect personal information in their care. Retailers should note that there is a big difference between examining identification, recording a name and address from it, recording the licence number, and photocopying the licence. Many business purposes can be satisfied by simply examining identification, or recording the name and address as displayed on it.”
Loblaw and George Weston Ltd. have admitted involvement in what Loblaw company officials have described as an industry wide price-fixing arrangement. Metro, Sobeys and Giant Tiger have denied involvement.
The arrangement took place between late 2001 and March 2015, affecting popular bread products in Canada.
Loblaw received immunity from criminal prosecution after reporting the activity to the Competition Bureau.
Loblaw Companies Ltd. recorded a charge of $ 107 million in the last quarter of 2017 in relation to the $ 25 card.