Privacy Commissioner Of Canada's Latest Findings Shed Light On The Requirements For Anonymizing Retained Data

Overview

The Personal Information Protection and Electronic Documents Act(“PIPEDA”) allows organizations to retain data that is no longer required to fulfill its purpose – but in doing so, the data must be properly anonymized. The question then arises: what does anonymizing mean for the purpose of PIPEDA’s data retention principle?

The Office of the Privacy Commissioner of Canada (“OPC”) recently dealt with this issue in its findings following an investigation into the Loblaw Companies Ltd. (“Loblaw”) data retention practices. In particular, the OPC investigated Loblaw’s treatment of data retained from deleted accounts relating to the PC Optimum Loyalty Program (“PC Optimum Program”). The OPC found that Loblaw failed to sufficiently anonymize the retained data and mitigate the risk of re-identification of former members. Accordingly, the OPC concluded that Loblaw had retained personal information longer than needed. In response, Loblaw agreed to have a third-party assessment