Canadian Tire Can Ask Questions

In his first ruling under the BC Personal Information Protection
Act, BC Information and Privacy Commissioner David Loukidelis has upheld the
practice of a Canadian Tire franchise in Kelowna of collecting personal
information from customers returning goods to the store.

The ruling follows a complaint by a customer who went to the store to return
an item she had purchased a few days before. She provided the customer
service clerk with the item's sale receipt and the Canadian Tire money
related to the purchase. The clerk asked for her name, address and
telephone number.

During a written inquiry, the store said that last year it processed more
than 70,000 merchandise refund transactions. It argued that the collection
of some customer information is necessary to combat the "serious problem" of
fraudulent merchandise returns.

The Commissioner was satisfied that "There is a real, not a merely perceived
or minimal, problem with the fraudulent return of stolen goods by supposed
customers, with or without sales receipts in hand. The organization has
other loss prevention measures in place, but collection and use of
identifying personal information is, it says, an important feature of its
overall loss-reduction strategy."

In finding the practice appropriate in the circumstances, the Commissioner
stated, "Here we have a retail organization facing ongoing challenges from
attempted and successful fraudulent return of stolen goods. We also have
collection and use of identifying information that is generally publicly
available and non-sensitive in nature. That information is collected and
used to detect and deter fraudulent returns of goods as part of its overall
loss-reduction strategy." He concluded, "The evidence shows that the
organization does not disclose the information to anyone else, except to the
police for fraud or theft investigations." He held that the organization
could require customers seeking to return goods to provide this limited
identifying information.

The Commissioner did not agree, however, that the store could require
customers to provide that same information so the organization could conduct
customer satisfaction surveys. He found that the store "must make it clear
that an individual is not required to provide personal information for
follow up customer satisfaction surveys." He also disagreed that the store
could retain this personal information indefinitely and required the store
to formulate a records retention policy and destroy or anonymize personal
information once it is no longer necessary.