PIPEDA Findings #2026-001: Investigation into the personal information retention practices of Loblaw for the PC Optimum Loyalty Program
The Office of the Privacy Commissioner of Canada (OPC) investigated complaints against Loblaw Companies Ltd. (Loblaw) regarding its PC Optimum Loyalty Program, focusing on the handling of privacy challenges and the retention of personal information. The investigation found that Loblaw contravened PIPEDA Principle 4.10 by failing to adequately address privacy challenges and respond to account deletion requests in a timely manner, though this issue was resolved during the investigation as Loblaw enhanced its procedures. The OPC also found that Loblaw contravened PIPEDA Principle 4.5.3 by not sufficiently anonymizing personal information retained from closed PC Optimum accounts, meaning there was a serious possibility of re-identification. Loblaw disagreed with this finding but agreed to engage an independent third party to assess its anonymization process and implement recommendations. A preliminary matter regarding requiring physical card holders to create an online account for deletion was found not well-founded. The overall outcome reflects a mix of resolved and conditionally resolved well-founded findings.
- 1Whether Loblaw adequately addresses privacy challenges raised by individuals concerning account deletion (PIPEDA Principle 4.10)
- 2Whether Loblaw retains personal information of PC Optimum members for longer than necessary after account closure (PIPEDA Principle 4.5.3)
- 3Whether Loblaw collected unnecessary personal information by requiring physical card holders to create an online account to delete their PC Optimum account (PIPEDA Principle 4.4)
- 4Whether Loblaw established retention schedules for customer support logs (PIPEDA Principle 4.5.2)
- 5Whether Loblaw retains universal login credentials (PCids) for longer than necessary for members with no other associated accounts (PIPEDA Principle 4.5.3)
- 6Whether Loblaw's anonymization process for retained Historical Transaction Data, Loyalty Data, and Usage Data ensures no serious possibility of re-identification
- 7Whether Loblaw's retention of public IP address data after account closure is sufficiently anonymized
- 8Whether Loblaw's practice of retaining email domain portions after account closure is sufficiently anonymized
- 9Whether manual processing errors in Loblaw's de-identification process were adequately detected and addressed
- 10Whether Loblaw ensured identifiers were removed from back-up systems as part of its anonymization process
- 11Whether Loblaw considered the impact of other factors affecting re-identification risk, such as separately retained PCid data
- Privacy challenges / deletion requests: Contravention found, issue resolved during investigation
- Anonymization of personal information: Contravention found, Loblaw to implement recommendations
- Online account for deletion: Complaint not well-founded
Complaint well-founded and resolved in part, well-founded and conditionally resolved in part, and not well-founded in part.
Loblaw failed to respond to privacy challenges in a timely manner but subsequently enhanced its procedures, and it failed to demonstrate that retained personal information from closed accounts was sufficiently anonymized, though it agreed to a third-party assessment and implementation of recommendations.
The OPC recommended Loblaw engage an independent third party to review its anonymization process for retained data and implement necessary risk mitigation measures, which Loblaw agreed to do, alongside establishing retention schedules for customer support logs and annually deleting inactive universal login credentials (PCids).
- Principle 4.10 PIPEDA
- Principle 4.5.3 PIPEDA
- Principle 4.4 PIPEDA
- Principle 4.5.2 PIPEDA
This summary is for informational purposes only and does not constitute legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro