Key Takeaways
- The Privacy Commissioner of Canada found that Staples Canada did not fully remove personal information from returned laptops that it later resold.
- Approximately 23% of analyzed laptops contained personal information, including names, email addresses, and partial images of faces.
- The commissioner has given Staples nine months to develop clear standards for wiping devices, improve staff training, and hire an independent third-party to conduct annual spot checks.
- The investigation was prompted by a former Staples sales associate who alleged that laptops were not always wiped following their return.
- The commissioner had previously audited Staples in 2011 over similar concerns and found that some of the same problems persisted 15 years later.
Introduction to the Investigation
The Privacy Commissioner of Canada has recently conducted an investigation into the data policies of Staples Canada, a leading retailer of office supplies and electronics. The investigation was prompted by a complaint from a former Staples sales associate who alleged that the company was not properly wiping personal information from returned laptops before reselling them. The commissioner’s office analyzed laptops returned by customers to four Ontario Staples stores and found that approximately 23% of the devices still contained personal information, including names, email addresses, account information, email fragments, and partial images of faces. This finding raises serious concerns about the protection of personal information and the potential for identity theft.
Findings of the Investigation
The investigation revealed that Staples Canada did not have adequate procedures in place to ensure that personal information was removed from returned laptops. In some cases, the laptops were found to still have the previous owner’s username and password showing on the device, making it easy for unauthorized individuals to access sensitive information. The commissioner’s office also found that some laptops were resold without being properly wiped, which is a clear violation of Canadian privacy laws. The fact that approximately 23% of the analyzed laptops contained personal information suggests that the problem is widespread and requires immediate attention from the company.
Previous Audit and Persistent Problems
The Privacy Commissioner of Canada had previously audited Staples in 2011 over similar concerns, and the recent investigation revealed that some of the same problems persisted 15 years later. This suggests that the company has not taken adequate steps to address the issues raised in the previous audit, and that its data policies and procedures require significant improvement. The commissioner’s office has given Staples nine months to develop clear standards for wiping devices, improve staff training, and hire an independent third-party to conduct annual spot checks on returned devices. This timeframe should provide the company with sufficient opportunity to address the concerns raised in the investigation and ensure that it is complying with Canadian privacy laws.
Consequences and Recommendations
The findings of the investigation have significant implications for Staples Canada and its customers. The company must take immediate action to address the concerns raised in the investigation and ensure that it is properly wiping personal information from returned laptops. The commissioner’s office has recommended that Staples develop clear standards for wiping devices, improve staff training, and hire an independent third-party to conduct annual spot checks. These measures should help to prevent the unauthorized disclosure of personal information and protect the privacy of customers. Additionally, the company should consider implementing more robust data policies and procedures to ensure that it is complying with Canadian privacy laws and protecting the sensitive information of its customers.
Conclusion and Future Actions
In conclusion, the investigation by the Privacy Commissioner of Canada has highlighted significant concerns about the protection of personal information at Staples Canada. The company must take immediate action to address these concerns and ensure that it is properly wiping personal information from returned laptops. The recommendations made by the commissioner’s office, including the development of clear standards for wiping devices, improvement of staff training, and hiring of an independent third-party to conduct annual spot checks, should help to prevent the unauthorized disclosure of personal information and protect the privacy of customers. As the company moves forward, it is essential that it prioritizes the protection of personal information and takes all necessary steps to comply with Canadian privacy laws. The commissioner’s office will likely continue to monitor the company’s progress and ensure that it is taking adequate measures to protect the sensitive information of its customers.
