Alberta’s privacy commissioner has ordered Staples Canada Inc. to develop security policies to protect the hard drives of customers who bring computers in for repair.
In September 2008, a Calgary customer filed a complaint after Staples returned the laptop without its hard drive.
The customer was told that the laptop could be “bought back” by Staples since it would cost just as much as to fix it as buying a new one.
The customer agreed to the store credit, but first asked to take the laptop home to wipe the hard drive clean of personal information, and discovered the hard drive was missing.
Adjudicator Teresa Cunningham, with the Office of the Information and Privacy Commissioner, determined that it was likely that the hard drive had been removed and destroyed in Winnipeg where the laptop was sent to be fixed.
The commissioner’s office found that Staples did not have reasonable security measures to protect against unauthorized destruction of the personal information stored on customers’ hard drives that Staples intends to buy out rather than repair.
On Jan. 5, Staples was ordered to ask customers if their computer contains a hard drive and whether they authorize disposal or destruction of any personal information on the hard drive in the event the computer is to be bought back or if the customer wants the information to be preserved.
Staples has 50 days to decide whether to accept the order and the company could seek a judicial review of the order before a Court of Queen’s Bench justice.
The order applies only to Staples stores in Alberta.
Wayne Wood, communications director with the commissioner, said Staples already offers a hard drive protection service.
“What we’re ordering them to do is have the proper procedures in place to make sure customers know,” Wood said.
Giving Staples 50 days to comply is appropriate, he said.
“They have a lot of stores in Alberta and it might require a lot of training of employees on what the new procedures are.”
“The order is specific to Staples. But it would certainly be a good idea if you are a company that does that kind of work and repairs computers that you might want to look at that order and have those policies and procedures in place too.”
The Red Deer Advocate was unable to contact anyone from Staples on Thursday.
szielinski@www.reddeeradvocate.com