Privacy commissioner investigating Loblaws for making people send ID for $25 gift cards

Canada's privacy commissioner is investigating Loblawsfordemanding that some customers hand overa copyof their driver's licenceor hydro bill to get their$25 gift card offered ascompensation for bread price fixing.

The commissionerhas fieldednumerous inquiries about Loblaws' ID request, and launched an investigation, Wednesday after a receivinga formalcomplaint.

Chris Brown in Ottawa filed a complaint last week after being asked forID.

"[Loblaws] promised a rebate and is now changing their promise by demanding unnecessary private information," he wrote.

Cynthia Mellaneyin Sudbury, Ont., also got the ID request and filed a complaint on Wednesday to the privacy commissioner.

"Advise Loblawsthis [is] far reaching and unnecessary when they committed fraud," she wrote.

ID Please

In January, Loblawsstarted offering $25 gift cards after admittingitsrole in aprice-fixing scandal in which the price of bread wasartificially inflatedfor more thana decade.

In order to collect, customers hadto fill inan online formproviding details includingtheir name and address.

While many peoplehave already received their cardin the mail without any additionalsteps, some have been told they need to either mail or send electronicallya copy oftheir driver's licenceor a utility billto Loblaws or they won't get anything.

The ID request has ignited a firestorm, with many customers complaining on social media and to CBC News that they feelthe request is inappropriate especially considering Loblaws offeredthe card to make amends for admitted wrongdoing.

Many alsoworry about security risks associated with sharing their personal information.

"That enables identity theft," Brown told CBCNews in an interview. "It can be used and skimmed for all kinds of purposes, regardless of the person collecting the information."

Mellaney shares this concern and has informed Loblawsshe won't be complying with the company's ID request.

"I basically said, 'I'm not supplying any additional personal information. You have address, you have my phone number.' I said, 'You can google me.'"

The Office of the Privacy Commissioner said it couldn't address specifics about its investigationat this time, but did provide a link to a page on its website concerning retailers collecting driver's licence information.

"The driver's licence number is sensitive and valuable to those intent on committing identity crimes," it states.

It also says that retailers "photocopying or scanning the licence generally goes too far," because a licence contains "more information than is needed for most business purposes."

Loblaws'welcomes' questions

Loblawstold CBC Newsit's taking the proper steps to protect customers' privacy, and that doing identity checks protects its customers' interests.

"We are distributing tens of millions of dollars in Loblaw Cards a natural target for fraudsters," spokesperson Kevin Grohsaid in an email.

"Checking ID confirms that we are dealing with a real person, and not someone using their name or taking money that could otherwise go to them now or in the future."

That explanation isn't good enough for Brown, who doesn't understand why he has to send in ID and other people don't. Loblaws says only a small percentage are being asked to confirm their identity first, and hasn't explained its selection process.

"Why am I suspected of fraud?" said Brown. "It's certainly offensive. Is it my address? Is it my name? And why should information on a private utility bill or a driver's licensebe shared with third parties internationally?"

Where's my data going?

Loblaws' privacy policy for its gift card program states personal data provided could be shared with three separate companies working with the grocer: prepaid card suppliers Blackhawk Network Canada and Peoples Trust Company, as well as U.S.-based legal administrative service company JND Legal Administration.

JNDis the gift card "program administrator" that'ssending the request to some customers to send in ID.

The privacy policy also states that "personal information may be stored, accessedor used in a country outside of Canada," including in the U.S. and El Salvador, where privacy laws may differ.

Cybersecurity experts CBC News spoke with said sharing data among several companies and countries raises the risk of a security breach.

"The more cooks in the kitchen, the more things can go wrong," said Ken Owen, a business technology management professor at Wilfrid Laurier University in Brantford, Ont. "That's just a lot of open territory for bad things to happen."

Spokesperson Groh said Loblaws takes the process very seriously, including using "expert third-party administrators" and destroying customers' documents once their identities have been confirmed.

As for upset customers, he offered an apology of sorts.

"For the small percentage we've asked for ID, we regret that this step slows the process slightly."