P2021-ND-102

At the end of March 2019, the Organization was contacted by two subscribers (resident outside Alberta) reporting possible fraudulent credit card activity, shortly after the subscribers spoke with a customer service representative (CSR) employed by a third party service provider to the Organization. The Organization investigated, and found that a CSR had used a subscriber?s credit card information (which had been collected for legitimate purposes) for an unauthorized personal purpose. The Organization reviewed all available web logs for all CSRs over the previous year in order to identify any other unauthorized use of personal information. The investigation found suspicious activity with respect to three CSRs over a period of approximately 3 months between January and March 2019. The investigation did not conclusively determine that personal information was used by these CSRs in an unauthorized manner, but 8 subscribers resident in Alberta provided their payment card data to one of these CSRs during this time period.