Department store revises process for collecting personal tax exemption information
Settled case summary #29
Lessons Learned
- Customers’ personal information should not be on view to other customers.
- Sometimes it requires only minimal reorganization to ensure that personal information is properly safeguarded.
Complaint
An individual went to the department store to make a purchase. When she identified herself at a checkout desk as being entitled to a provincial tax exemption, she was asked to write her personal information on a petition style form. To her dismay, she was able to see the names of other customers who had completed the tax exemption register before her, as well as the dates they had shopped at the store and their tax exemption numbers. She realized that, after she had filled in her own information, other customers in turn would have access to her personal data.
Outcome
The department store confirmed that it used a petition-style format to record the personal information of customers who had tax exempt status. As a result of the individual’s complaint, the store undertook to change how it collected the information.
As a temporary measure, the retailer designed a new form to record the information of customers applying for the provincial tax exemption, and sent the form to all of its Canadian stores. Only one customer’s information would appear on each of the form’s pages. This prevented customers from viewing the information of others who had completed a request for a tax exemption.
In the meantime, the store reconfigured its cash registers so as to add an electronic tax exempt code to each machine. When a customer indicated that she or he had a tax exemption number, the register operator would key in that request code, and the cash register would print a receipt-style form. After the customer completed the form, it would be placed in the register under the cash tray. Therefore, a form would be generated only at the time of a transaction; it would be given directly to the customer; and, it would be kept secure in the cash register, rather than on a clip board. This practice was implemented in all of the company’s Canadian stores, at which time the temporary measure was discontinued.
The complainant indicated that she was very pleased with the store’s actions. The Commissioner and the complainant therefore considered the matter to be settled during the course of the investigation.
See also
#304 Movie theatre chain strengthens personal information handling practices
- Date modified: