Information and Privacy Commissioner Frank Work today announced he will investigate how thousands of customers’ records wound up in an Edmonton hotel room. Edmonton police discovered the records during a criminal investigation, which has resulted in charges being laid against two individuals.
The information at issue consists of sensitive personal financial information of individuals, such as cell phone contracts, credit information held by a debt collection agency, bank records, and return of goods slips with detailed credit card information.
The organizations under investigation are Linens ‘N Things, Nor-Don Collection Network Inc., and Digital Communications Group Ltd.
“The prospect of identity theft built on inappropriately discarded information is deeply troubling,” said Commissioner Work. “My office will fully investigate this matter and take whatever steps are necessary to ensure this does not happen in the future.”
The Office of the Information and Privacy Commissioner was already investigating the disclosure of Alberta senior civil servants’ credit reports. This second investigation will focus on the private sector organizations’ responsibilities to safeguard personal information under Section 34 of Alberta’s Personal Information Protection Act (PIPA).
A final report will be published by the Commissioner.
The Commissioner reminds organizations of the risk that results from insecure disposal and destruction of personal information. Among other things, organizations should:
- shred or permanently destroy paper records that reveal personal information of customers or employees
- limit the personal information collected in the first place
- limit access to those who need to know
- pay attention to the disposal of electronic information – hard drives must be completely wiped, and electronic storage media must be securely destroyed
- look in garbage and recycle bins and examine what they are handing to identity thieves.