Last week, the Privacy Commissioner of Canada determined that
Loblaw Companies Ltd. initially collected more personal information
than it needed with respect to the $25 Loblaw gift cards it made
available to customers affected by a bread price-fixing scheme in
which Loblaw participated. Specifically, Loblaw should have
advised, and later did advise, prospective gift card holders that
they could redact personal information that did not verify
eligibility for the gift card program from the copies of utility
bills or driver licences information. More interestingly, the
Commissioner accepted as compliant with federal privacy law
(PIPEDA) Loblaw's privacy policy and related consent Loblaw
obtained from prospective gift card holders to share their personal
information with the third parties Loblaw engaged to handle its
gift card program, including a third party in the U.S.
