News Release

January 31, 2007

Federal Privacy Commissioner and Alberta Information and Privacy Commissioner to investigate Winners and HomeSense data breach

The Privacy Commissioner of Canada, Jennifer Stoddart, and the Information and Privacy Commissioner of Alberta, Frank Work, will jointly investigate how the database of TJX Companies Inc. was breached, and how it affects Canadians who shopped at Winners Merchants Inc. and HomeSense, which are owned by parent company TJX.

“I am profoundly concerned about incidents of this nature that put at risk individuals’ personal information,” said Ms. Stoddart. “I look forward to once again working with Commissioner Work and his Office on a joint investigation, and to identifying corrective measures to ensure this kind of major privacy breach does not reoccur.”

The federal Commissioner decided to launch an investigation of TJX to ascertain whether there has been a contravention of the Personal Information Protection and Electronic Documents Act (PIPEDA). She will also investigate Winners and HomeSense following a complaint recently received by her Office.

The breach allegedly exposed the personal information of Canadian consumers of these retailers to unauthorized access and the company has provided “Customer Alerts” on its Web sites. However, after numerous calls from concerned Albertans, Alberta’s Information and Privacy Commissioner decided to investigate the personal information collection practices of the two retailers under the Personal Information Protection Act (PIPA). Mr. Work’s investigation will focus on the Alberta outlets of Winners Merchants Inc./HomeSense.

Both offices will work together with the company to remedy the situation. The investigation will include, for example, a close look at the collection of personal information and whether appropriate security safeguards are in place to protect consumers against unauthorized access, use and disclosure of personal information.

Alberta Commissioner, Frank Work, is concerned about the kind of information and the length of time it is held. “Some of the information that was breached dates back to 2003, and I would like to know the reasons why the company feels it has retained sensitive customer information for that long. I also want to know what kind of information is collected.”

Since privacy breaches can potentially expose individuals to problems such as identity theft, Canadians are encouraged to visit the Web sites of the Office of the Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner of Alberta for tips on how to safeguard their personal information.

— 30 —

For more information, please contact:

Wayne Wood
Communications Director
Alberta Office of the Information and Privacy Commissioner
Tel: (780) 427-4132
E-mail: wwood@oipc.ab.ca

Anne-Marie Hayden
Office of the Privacy Commissioner of Canada
Tel: (613) 995-0103
E-mail: ahayden@privcom.gc.ca