PIPEDA Findings #2025-004: Investigation into the privacy practices of Staples Canada ULC related to electronic devices to be resold as part of its Openbox program
This investigation examined Staples Canada's practices concerning the removal of personal information from returned laptops resold through its Openbox program. The Office of the Privacy Commissioner of Canada (OPC) found that Staples had deficiencies in its policies, procedures, and employee training regarding data wiping. Specifically, the OPC determined that Staples did not consistently ensure full data sanitization according to manufacturer guidelines, leading to residual personal information being found on some devices. Staples agreed to implement corrective measures, including updating procedures, enhancing training, and engaging third-party spot checks.
- Adequacy of safeguards for personal information on returned electronic devices
- Sufficiency of Staples' policies and procedures for data wiping
- Effectiveness of employee training on data sanitization
- Compliance with PIPEDA Principles 4.7.1 and 4.7.3
Complaint well-founded and conditionally resolved
The OPC found that Staples contravened PIPEDA Principles 4.7.1 and 4.7.3 due to inadequate procedures and training that failed to ensure the consistent and complete removal of personal information from returned laptops before resale. Staples' commitment to implementing corrective measures led to a conditionally resolved outcome.
AI-generated summary for reference only. Always verify against the official decision ↗
Staples agreed to develop clear procedures for wiping devices according to manufacturer guidelines, improve employee training, ensure staff completion of training, and arrange for annual independent third-party spot checks of returned devices for three years.
- Principle 4.7.1 PIPEDA
- Principle 4.7.3 PIPEDA
This summary is informational only and not legal advice.