Canada: Office of the Privacy Commissioner found Loblaw Companies in violation of personal information retention practices

On 5 March 2026, the Office of the Privacy Commissioner of Canada published the findings of an investigation into Loblaw Companies regarding the retention of purchase histories linked to former members of the PC Optimum loyalty programme. The investigation examined whether Loblaw handled privacy-related inquiries in line with Principle with Personal Information Protection and Electronic Documents Act (PIPEDA), and whether it retained personal information only as long as necessary after account deletion. The OPC found that Loblaw did not respond to all deletion requests in a timely manner. During the investigation, the company updated its internal procedures to improve the handling of such requests. The OPC also found that Loblaw retained certain data, including historical transaction, loyalty, and usage data, without demonstrating that the information had been sufficiently anonymised. Loblaw agreed to commission an independent third-party assessment of its anonymisation processes and to implement any recommended measures within 12 months of the report being issued.