Canadian privacy & access decisions

VTech Holdings Limited, a connected toy manufacturer, experienced a global data breach affecting over 316,000 Canadian children and 237,000 Canadian adults. The OPC launched an investigation after receiving a complaint from an affected Canadian. The investigation revealed significant safeguard deficiencies, including a lack of testing, inadequate access controls, cryptographic weaknesses, and no comprehensive security management program. These deficiencies were not commensurate with the sensitivity of the information, especially that of children. However, VTech implemented timely and comprehensive measures to contain the breach, mitigate risks to affected individuals, and address safeguard concerns during the investigation. The OPC concluded that the matter was well-founded and resolved due to these corrective actions.

• Whether VTech Holdings Limited failed to adequately safeguard personal information under Principle 4.7 PIPEDA
• Whether VTech's security safeguards were appropriate to the sensitivity of the information (Principle 4.7 PIPEDA)
• Whether VTech's safeguards protected against unauthorized access, disclosure, copying, use, or modification (Principle 4.7.1 PIPEDA)
• Whether the nature of VTech's safeguards varied depending on the sensitivity, amount, distribution, format, and storage method of the information (Principle 4.7.2 PIPEDA)
• Whether VTech's methods of protection included physical, organizational, and technological measures (Principle 4.7.3 PIPEDA)
• Whether VTech had adequate testing and maintenance protocols to identify and mitigate vulnerabilities
• Whether VTech had adequate administrative access controls
• Whether VTech had adequate cryptographic protection for personal information
• Whether VTech had sufficient security monitoring and logging to detect threats
• Whether VTech had a comprehensive security management program

A complainant objected to a retail store retaining records of her credit card transactions and refusing to delete them upon request. The store initially cited contractual obligations with credit card companies. During the OPC's investigation, the retail company provided a more detailed explanation, including its legal obligations under the Excise Tax Act to retain transactional data. The OPC relayed this information to the complainant, who was satisfied with the explanation and considered the matter resolved. The complainant noted that if this information had been provided initially, she would not have filed a complaint.

• Whether a retail store's retention of credit card transaction records without deletion upon request violated PIPEDA's consent principle
• Whether legal or contractual obligations justified the retention of personal information despite a withdrawal of consent