Privacy commissioner investigating Loblaws for making people send ID for $25 gift cards

Canada's privacy commissioner is investigating Loblaws for demanding that some customers hand over a copy of their driver's licence or hydro bill to get their $25 gift card — offered as compensation for bread price fixing. 

The commissioner has fielded numerous inquiries about Loblaws' ID request, and launched an investigation, Wednesday after a receiving a formal complaint. 

Chris Brown in Ottawa filed a complaint last week after being asked for ID.

"[Loblaws] promised a rebate and is now changing their promise by demanding unnecessary private information," he wrote.

Cynthia Mellaney in Sudbury, Ont., also got the ID request and filed a complaint on Wednesday to the privacy commissioner.

"Advise Loblaws this [is] far reaching and unnecessary when they committed fraud," she wrote. 

ID Please

In January, Loblaws started offering $25 gift cards after admitting its role in a price-fixing scandal in which the price of bread was artificially inflated for more than a decade.

In order to collect, customers had to fill in an online form providing details including their name and address. 

While many people have already received their card in the mail without any additional steps, some have been told they need to either mail or send electronically a copy of their driver's licence or a utility bill to Loblaws — or they won't get anything.

The ID request has ignited a firestorm, with many customers complaining on social media and to CBC News that they feel the request is inappropriate — especially considering Loblaws offered the card to make amends for admitted wrongdoing.

Many also worry about security risks associated with sharing their personal information.

"That enables identity theft," Brown told CBC News in an interview. "It can be used and skimmed for all kinds of purposes, regardless of the person collecting the information."

Mellaney shares this concern and has informed Loblaws she won't be complying with the company's ID request. 

"I basically said, 'I'm not supplying any additional personal information. You have address, you have my phone number.' I said, 'You can google me.'"

The Office of the Privacy Commissioner said it couldn't address specifics about its investigation at this time, but did provide a link to a page on its website concerning retailers collecting driver's licence information.

"The driver's licence number is sensitive and valuable to those intent on committing identity crimes," it states.

It also says that retailers "photocopying or scanning the licence generally goes too far," because a licence contains "more information than is needed for most business purposes."

Loblaws 'welcomes' questions

Loblaws told CBC News it's taking the proper steps to protect customers' privacy, and that doing identity checks protects its customers' interests.

"We are distributing tens of millions of dollars in Loblaw Cards — a natural target for fraudsters," spokesperson Kevin Groh said in an email.

"Checking ID confirms that we are dealing with a real person, and not someone using their name or taking money that could otherwise go to them now or in the future."

That explanation isn't good enough for Brown, who doesn't understand why he has to send in ID and other people don't. Loblaws says only a small percentage are being asked to confirm their identity first, and hasn't explained its selection process.

"Why am I suspected of fraud?" said Brown. "It's certainly offensive. Is it my address? Is it my name? And why should information on a private utility bill or a driver's license be shared with third parties internationally?"

Where's my data going?

Loblaws' privacy policy for its gift card program states personal data provided could be shared with three separate companies working with the grocer: prepaid card suppliers Blackhawk Network Canada and Peoples Trust Company, as well as U.S.-based legal administrative service company JND Legal Administration. 

JND is the gift card "program administrator" that's sending the request to some customers to send in ID. 

The privacy policy also states that "personal information may be stored, accessed or used in a country outside of Canada," including in the U.S. and El Salvador, where privacy laws may differ.

Cybersecurity experts CBC News spoke with said sharing data among several companies and countries raises the risk of a security breach.

"The more cooks in the kitchen, the more things can go wrong," said Ken Owen, a business technology management professor at Wilfrid Laurier University in Brantford, Ont. "That's just a lot of open territory for bad things to happen."

Spokesperson Groh said Loblaws takes the process very seriously, including using "expert third-party administrators" and destroying customers' documents once their identities have been confirmed.

As for upset customers, he offered an apology of sorts.

"For the small percentage we've asked for ID, we regret that this step slows the process slightly."