Commissioner's Findings

Settled case summary #1

Store implements changes following laptop lapse

Complaint

The complainant brought her laptop to the store where she purchased it for repair. When it was not fixed within the time limit prescribed by store policy, the company gave the complainant a new computer. A few months later, she received a phone call from an individual who had some surprising news for her: he had purchased the complainant's original laptop from the store, and it still contained her personal information. The complainant was very concerned about the lack of safeguards that led to this disclosure of her personal information.

Outcome

It turned out that an employee had placed the returned laptop for sale without examining it. As a result, it was sold, with her personal information still on it. The company was able to retrieve the machine and returned it to the complainant. As a result of this incident, the company implemented a number of significant changes to safeguard customers' personal information to the greatest extent possible. It now ensures that it completely wipes out customer information on any computer hard drive returned to any of its stores across Canada — an action that employees will have to document. The company also agreed to implement similar procedures for safeguarding personal information for other electronic devices that it sells.

The complainant was pleased that the company had made changes so that what happened to her would not happen to other customers.