Canada’s Privacy Commissioner found Staples Canada did not fully remove personal information from returned laptops it later resold. Staff sampled devices returned to four Ontario stores and found personal information on 23 per cent of them. Staples was given nine months to set clear wiping standards, improve training and arrange independent annual spot checks.
What investigators found on the devices
The Office of the Privacy Commissioner of Canada said its staff analysed laptops that customers had returned to four Ontario Staples stores. On 23 per cent of the devices sampled, personal information from a previous owner was still present.
The material that remained included names, email addresses and account information. Investigators also found fragments of emails and partial images of faces. In other words, a person who bought a resold laptop could, in some cases, encounter traces of the customer who had owned and returned it before them.
The finding was about the company’s systems, not a single store or a single employee. The commissioner identified gaps in the policies, procedures and training that are supposed to ensure a returned device is wiped before it goes back on sale.
A complaint from a former employee
The investigation did not begin at random. The commissioner started looking into Staples after a former sales associate complained that returned laptops were not always wiped.
According to the complaint, some computers were kept in storage with the previous owner’s username and password still showing on the device. In at least one case, the former employee said he saw a laptop resold while it still carried unwiped personal information from an earlier customer.
Those allegations gave investigators a specific claim to test. Their sampling of returned devices at the four Ontario stores then showed that the concern was not limited to one remembered incident.
The same problem identified 15 years earlier
The most pointed part of the findings is that this has happened before. The privacy commissioner audited Staples in 2011 over similar concerns about returned devices.
At that time, the company committed to improving its practices, including testing different ways of wiping data. The new investigation concluded that some of the same problems were still present 15 years later.
That history matters for Ontario shoppers because Staples is not a small, one-off seller. A legal analysis of the findings published after the announcement noted the retailer operates more than 300 stores across Canada and resells returned laptops through its open-box program. A weakness in a standard process can therefore affect customers in many communities, not only at the stores sampled.
What Staples has been told to do
The commissioner gave Staples nine months to act on a set of recommendations, and the company confirmed it is updating its policies and will implement them.
The measures include developing clear standards for wiping devices, consistent with manufacturers’ guidelines for factory resets and data sanitization. Staples must also improve training for the employees responsible for wiping returned devices, and make sure staff complete that training before they are assigned the task.
The third measure is outside checking. Staples agreed to hire an independent third party to carry out an annual spot check of returned devices. A legal summary of the investigation said those spot checks are to run once a year for three years at stores taking part in the open-box program.
A warning for every retailer that resells devices
The commissioner used the Staples case to remind all businesses covered by the Personal Information Protection and Electronic Documents Act, Canada’s federal private-sector privacy law, of three basic duties when they resell returned electronics.
First, perform a factory reset using the manufacturer’s instructions to fully wipe personal information. Second, give employees clear, consistent and standardized instructions for removing that information. Third, train staff fully so they can carry out the technical steps involved.
For customers, the practical lesson runs in the other direction as well. Anyone returning a laptop, phone or tablet to any retailer should remove accounts and personal files and run a factory reset before handing the device over, rather than relying entirely on the store to do it. The investigation shows why that extra step matters, even at a national chain: a return counter is not, by itself, a guarantee that the previous owner’s data is gone.
