PIPEDA Findings #2025-004: Investigation into the privacy practices of Staples Canada ULC related to electronic devices to be resold as part of its Openbox program
A former employee complained that Staples Canada ULC (Staples) failed to adequately protect and remove personal information from returned laptops before reselling them through its Openbox program. The complainant alleged that Staples lacked adequate internal policies, processes, and training for staff to wipe data from these devices. The OPC's investigation found deficiencies in Staples' policies, procedures, and training, and that employees did not consistently follow manufacturer guidelines for data wiping, leading to residual personal information on 23% of sampled devices. Staples agreed to implement recommendations to improve its data wiping procedures, training, and to arrange for independent third-party spot checks. The OPC concluded that Staples contravened PIPEDA Principles 4.7.1 and 4.7.3.
- 1Whether Staples had adequate security safeguards to protect personal information on returned laptops under Principle 4.7.1 PIPEDA
- 2Whether Staples' methods of protection included adequate physical, organizational, and technological measures under Principle 4.7.3 PIPEDA
- 3Whether Staples' internal policies and procedures for data wiping were clear and consistent
- 4Whether Staples provided adequate training to employees responsible for wiping data from returned devices
- 5Whether Staples consistently performed full data wipes according to manufacturer instructions on returned laptops
- Data protection on returns: Staples contravened PIPEDA Principles 4.7.1 and 4.7.3
- Adequacy of policies/procedures: Deficiencies found in Staples' policies and procedures
- Staff training: Deficiencies found in Staples' staff training
- Implementation of recommendations: Staples agreed to implement recommendations
- Future compliance measures: Staples agreed to independent third-party spot checks
Complaint well-founded and conditionally resolved
The OPC found that Staples contravened PIPEDA Principles 4.7.1 and 4.7.3 due to inadequate procedures, training, and inconsistent data wiping practices. Staples agreed to implement the OPC's recommendations to address these deficiencies, leading to a conditionally resolved outcome.
Staples agreed to develop clear data wiping procedures consistent with manufacturer guidelines, improve employee training, ensure all relevant employees complete training, and arrange for annual independent third-party spot checks of returned devices for three years.
- Principle 4.7.1 PIPEDA
- Principle 4.7.3 PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro