Canadian privacy & access decisions

A complainant objected to a retail store retaining records of her credit card transactions and refusing to delete them upon request. The store initially cited contractual obligations with credit card companies. During the OPC's investigation, the retail company provided a more detailed explanation, including its legal obligations under the Excise Tax Act to retain transactional data. The OPC relayed this information to the complainant, who was satisfied with the explanation and considered the matter resolved. The complainant noted that if this information had been provided initially, she would not have filed a complaint.

• Whether a retail store's retention of credit card transaction records without deletion upon request violated PIPEDA's consent principle
• Whether legal or contractual obligations justified the retention of personal information despite a withdrawal of consent