The federal privacy watchdog has determined that Staples Canada failed to fully erase personal data from returned laptops before reselling them. According to the Office of the Privacy Commissioner of Canada, an examination of laptops returned to four Staples stores in Ontario revealed that 23% of the devices still contained personal information such as names, email addresses, account details, email snippets, and partial facial images.
As a result of the findings, the privacy commissioner has instructed Staples to establish clear protocols for data erasure, enhance staff training, and engage an independent third party to perform annual checks on returned devices. This directive follows an investigation initiated after a former Staples employee alleged that laptops were not consistently wiped clean upon return.
Instances were reported where the complainant observed computers being stored with the previous owner’s login credentials visible and even encountered a case where a resold laptop contained personal data from a prior user. The commissioner noted that similar issues were identified during a previous audit of Staples in 2011, indicating persistent shortcomings in data handling practices over a span of 15 years.