Canada's privacy commissioner wants to know why Loblaws is demanding some customers hand over a copy of their driver's licence or hydro bill to get their $25 gift card.
The commissioner's request follows a CBC News report on customer outrage over the extra step to claim their rebate.
In January, Loblaws started offering $25 gift cards after admitting its role in a price-fixing scandal in which the price of bread was artificially inflated for more than a decade.
In order to collect, customers had to fill in an online form providing details including their name and address.
While many people have already received their card in the mail without any additional steps, some have been told they need to either mail or send electronically a copy of their driver's licence or a utility bill to Loblaws — or they won't get anything.
Won’t be giving my private info all for a $25 card that #Loblaws OWES ME!! Wow, they commit fraud then want MY info??!! #boycottLoblaws@LoblawsON
— @LilOldMee
#loblaws you really have nerve asking for ID for a $25 gift card after decades of ripping me and others off
— @maritimeaccord
The ID request has ignited a firestorm, with many customers complaining on social media and to CBC News that they feel the request is inappropriate — especially considering Loblaws offered the card to make amends for admitted wrongdoing.
Many also worry about security risks associated with sharing their personal information.
"That enables identity theft," said Loblaws customer Chris Brown, of Ottawa. "It can be used and skimmed for all kinds of purposes, regardless of the person collecting the information."
He filed a complaint last week with the privacy commissioner after he got the request to provide his ID.
"I already gave Loblaws my address, my name, certainly information that's plenty enough to verify me," said Brown.
Chris Brown, of Ottawa, filed a complaint with the privacy commissioner after receiving a request from Loblaws to provide a copy of his driver's licence or a utility bill. (Submitted by Chris Brown)
The Office of the Privacy Commissioner said it couldn't address specifics about Loblaws' ID request at this time, but did provide a link to a page on its website concerning retailers collecting driver's licence information.
"The driver's licence number is sensitive and valuable to those intent on committing identity crimes," it states.
It also says that retailers "photocopying or scanning the licence generally goes too far," because a licence contains "more information than is needed for most business purposes."
Loblaws 'welcomes' questions
Loblaws told CBC News it "welcomes" the privacy commissioner's interest, because it allows the company to show it's taking the proper steps to protect customers' privacy. The retailer also said doing identity checks protects its customers' interests.
"We are distributing tens of millions of dollars in Loblaw Cards — a natural target for fraudsters," spokesperson Kevin Groh said in an email.
"Checking ID confirms that we are dealing with a real person, and not someone using their name or taking money that could otherwise go to them now or in the future."
That explanation isn't good enough for Brown, who doesn't understand why he has to send in ID and other people don't. Loblaws says only a small percentage are being asked to confirm their identity first, and hasn't explained its selection process.
"Why am I suspected of fraud?" said Brown. "It's certainly offensive. Is it my address? Is it my name? And why should information on a private utility bill or a driver's license be shared with third parties internationally?"
Where's my data going?
Loblaws' privacy policy for its gift card program states personal data provided could be shared with three separate companies working with the grocer: prepaid card suppliers Blackhawk Network Canada and Peoples Trust Company, as well as U.S.-based legal administrative service company JND Legal Administration.
JND is the gift card "program administrator" that's sending the request to some customers to send in ID.
The privacy policy also states that "personal information may be stored, accessed or used in a country outside of Canada," including in the U.S. and El Salvador, where privacy laws may differ.
Robyn Fleming, of St. John's, N.L., was displeased to get this email from Loblaws requesting she send identification before getting her $25 gift card. (Robyn Fleming)
Cybersecurity experts CBC News spoke with said sharing data among several companies and countries raises the risk of a security breach.
"The more cooks in the kitchen, the more things can go wrong," said Ken Owen, a business technology management professor at Wilfrid Laurier University in Brantford, Ont. "That's just a lot of open territory for bad things to happen."
Spokesperson Groh said Loblaws takes the process very seriously, including using "expert third-party administrators" and destroying customers' documents once their identities have been confirmed.
As for upset customers, he offered an apology of sorts.
"For the small percentage we've asked for ID, we regret that this step slows the process slightly."
from CBC | Top Stories News http://ift.tt/2FHlOKz
http://ift.tt/2FArYQJ Source Link
No comments:
Post a Comment