Federal (Canada) privacy & access decisions

A complainant objected to a retail store retaining records of her credit card transactions and refusing to delete them upon request. The store initially cited contractual obligations with credit card companies. During the OPC's investigation, the retail company provided a more detailed explanation, including its legal obligations under the Excise Tax Act to retain transactional data. The OPC relayed this information to the complainant, who was satisfied with the explanation and considered the matter resolved. The complainant noted that if this information had been provided initially, she would not have filed a complaint.

• Whether a retail store's retention of credit card transaction records without deletion upon request violated PIPEDA's consent principle
• Whether legal or contractual obligations justified the retention of personal information despite a withdrawal of consent

This case summary details multiple breach incidents reported to the OPC in 2017, all stemming from password reuse by individuals. In each incident, unauthorized third parties gained access to customer accounts using login credentials obtained from previous, unrelated data breaches. An airline, a retailer, and a digital media company were affected, with personal information of thousands of customers compromised. The OPC reviewed the responses of each organization, noting their actions to mitigate risks, notify affected individuals, and enhance security controls. The OPC concluded that each organization's response was appropriate and satisfactory, demonstrating positive steps to prevent recurrence. The report emphasizes the importance of avoiding password reuse and encourages organizations to implement similar preventative measures.

• Whether organizations adequately responded to breaches caused by password reuse
• Whether organizations implemented appropriate safeguards to prevent recurrence of breaches due to password reuse