What the Commissioner found

In March 2026 the Office of the Privacy Commissioner published its findings on Loblaw’s PC Optimum loyalty program. When members deleted their accounts, Loblaw removed names and contact details but kept their purchase histories, points activity, and online usage data, including IP addresses and device information. The company called that anonymized. The Commissioner disagreed, and found Loblaw had breached the retention principle in PIPEDA, the federal private-sector privacy law. It also found the company was too slow to answer the complaints. Loblaw agreed to have its process independently reviewed.

Why removing a name is not deleting

PIPEDA says personal information you no longer need should be destroyed, erased, or made anonymous. The finding set a clear bar for that last option: there must be no serious possibility that someone could be re-identified, either from the data alone or by combining it with other available information. Stripping the name does not meet that bar when what is left still points to a person. An IP address can show roughly where someone lives. A work email domain reveals an employer. In a small community, a distinctive buying pattern can identify someone on its own. The Commissioner also noted that Loblaw had no proven way to clear the data out of its backups.

The stakes are rising, too. Bill C-36, the proposed replacement for PIPEDA, would add penalties of up to $10 million or 3% of global revenue, plus a right for individuals to sue. It has not passed, but the direction is clear.

A retention routine for a small business

You do not need a privacy department. You do need a few habits:

  • Know where the data lives. Form submissions stored in WordPress, old order records, abandoned carts, newsletter lists, server logs, and backups all count.
  • Set a retention period for each one and write it in your privacy policy. Keep only what you have a real reason to keep, like tax records for the period the CRA requires.
  • Delete for real. When a customer asks to be removed, delete the record. Do not just mark it inactive or blank out the name.
  • Let backups age out. Keep backup retention short and documented, so deleted data does not live on for years.
  • Answer requests promptly. Slow responses were a separate finding against Loblaw.

On the sites I host at Design Menu, the most common gap is contact-form plugins quietly keeping every message ever sent. Five minutes in the plugin settings fixes it, and it is a far easier conversation than the one Loblaw had.