Loblaw did not demonstrate that information kept after customers closed their PC Optimum accounts was adequately anonymized, the Privacy Commissioner of Canada found in a report that distinguishes removing obvious identifiers from making data genuinely anonymous.
The March 5, 2026 report, PIPEDA Findings #2026-001, found that Loblaw retained personal information longer than necessary for its original purpose. Loblaw disputed that conclusion but agreed to an independent assessment of its anonymization process and to implement necessary risk-reduction measures recommended by that review within 12 months of the report.
The commissioner classified the retention complaint as well-founded and conditionally resolved. A separate finding that Loblaw mishandled privacy inquiries was resolved after the company improved its procedures. The report imposes no monetary penalty or compensation award.
What remained after account closure
The investigation followed six complaints about account deletion, purchase-history retention and unanswered inquiries. The report said the complaints began arriving in May 2024, when account closures appeared connected to a consumer boycott. It described PC Optimum as a program with more than 17 million members across Canada.
Loblaw told the commissioner that it removed identifying profile details when closing an online account but retained purchase transactions, loyalty information and online usage data. It said the retained information supported analytics, program operations, product development and analysis of customer trends.
The commissioner accepted that federal privacy law allows information no longer needed for its original purpose to be made anonymous rather than destroyed. But an organization choosing that route must show there is no serious possibility of identifying someone from the retained data, whether used on its own or combined with other available information.
That assessment must continue over time, the report said. A dataset that appears less identifying today can become more revealing as technology improves or other information becomes available. Removing names, phone numbers and email addresses did not, by itself, demonstrate that Loblaw had met the standard.
Why the explanation fell short
The commissioner identified several concerns, including public IP addresses that could help approximate a person's location, detailed purchasing patterns and the possibility of linking retained information with other records. The report's example of a distinctive purchase in a small community illustrated a potential identification risk; it was not a finding that a particular shopper had actually been identified that way.
The report also examined replacement email addresses. Loblaw initially said staff replaced the portion before the @ symbol, leaving the domain intact. It later said the whole address was replaced, but the commissioner found that this did not explain contrary evidence or the company's earlier account. The commissioner concluded that domains were retained at least some of the time.
In one complaint, an employee put the customer's name into a replacement address instead of a random string. The commissioner also found that Loblaw had not demonstrated a process for removing identifiers from backup systems or provided sufficient documentation of protections against linking data held in separate systems.
Loblaw said only designated staff could access the retained data and that customer-support agents with access to correspondence and original login information could not access the de-identified dataset. It also said it was enhancing training. The commissioner nevertheless found the information supplied insufficient to establish effective anonymization.
The report did not rule out legitimate use of anonymous data. It described technical safeguards, including combining or altering data, alongside access limits, training and prohibitions on attempts to identify people. Loblaw's retained transaction, usage and loyalty information remained associated as a separate dataset for each former member, rather than being aggregated, scrambled or perturbed.
Different findings on service and retention
Loblaw acknowledged delays and incomplete responses to deletion inquiries between May and July 2024, citing unusually high volumes and technical problems. During the investigation, it reviewed its workflow, trained staff, fixed confirmation-email issues and confirmed account deletion to all six complainants. Those improvements resolved the finding under PIPEDA's complaint-handling principle.
The commissioner rejected another complaint that a physical-card user had to create an online account to leave the program. Loblaw said that instruction resulted from a miscommunication and that physical-card users could end their participation by destroying the card. That conclusion did not resolve the separate concerns about retained transaction and loyalty data.
The report also addressed PCid, the login used across Loblaw services. Keeping it could be reasonable where another associated account remained active. Loblaw agreed to review inactive credentials at least annually and delete credentials with no active account, including specified situations where other accounts had been inactive long enough to reasonably be treated as inactive.
For the unresolved anonymization issue, Loblaw agreed to provide the commissioner with a summary of the independent assessment and implement necessary recommended safeguards within the stated 12-month period. The report records that commitment, not a finding that the assessment or implementation had already been completed.
