Privacy Commissioner concludes Loblaw loyalty program investigation

Canada OPC News & Actions

Filed March 5th, 2026

Detected March 13th, 2026

Summary

The Privacy Commissioner of Canada has concluded an investigation into Loblaw's PC Optimum Loyalty Program. The investigation found that Loblaw failed to respond to deletion requests in a timely manner and retained purchase history after account deletion, violating privacy regulations. Loblaw has agreed to implement recommendations to improve its processes.

View original document View source feed page

What changed

The Office of the Privacy Commissioner of Canada (OPC) has issued findings regarding an investigation into Loblaw Companies Ltd. concerning its PC Optimum Loyalty Program. The investigation determined that Loblaw did not adequately address customer requests for account deletion, took an unreasonable amount of time to respond to such requests, and failed to respond to some privacy inquiries. Furthermore, Loblaw retained member purchase history after account deletion, and its anonymization measures were deemed insufficient to prevent potential re-identification of individuals.

Loblaw has committed to implementing the Commissioner's recommendations, which include ensuring timely responses to privacy-related requests, independently reviewing its anonymization process, and implementing necessary risk mitigation measures. While this is an investigation finding and not a formal enforcement action with penalties, regulated entities should review their data retention and deletion policies to ensure compliance with privacy laws and timely handling of customer requests. Failure to do so could lead to similar investigations and reputational damage.

What to do next

Review data retention and deletion policies for compliance with privacy regulations.
Ensure timely response mechanisms are in place for customer data requests.
Assess and strengthen data anonymization and de-identification processes.

Source document (simplified)

News release

Privacy Commissioner of Canada concludes investigation into complaints related to Loblaw loyalty program

March 5, 2026 – Gatineau, Quebec

Privacy Commissioner of Canada Philippe Dufresne has issued the findings in an investigation into complaints against Loblaw Companies Ltd. related to the PC Optimum Loyalty Program.

Several complainants alleged that Loblaw did not delete their PC Optimum accounts after they requested it, and/or that it had not responded to inquiries about their deletion requests.

The investigation found that, while Loblaw had mechanisms in place for customers to request an account deletion or to raise privacy concerns, it took an unreasonable amount of time to address the requests, and also failed to respond to some privacy-related inquiries.

The investigation also found that Loblaw retained PC Optimum members’ purchase history after their account had been deleted and that the removal of personal identifiers such as names and email addresses was an insufficient measure to have in place. Loblaw did not demonstrate that it had adequate measures in place, namely to limit the risk that individuals could be identified.

During the investigation, Loblaw took steps to ensure that individuals’ privacy-related requests are responded to in a timely way going forward.

Loblaw agreed to implement the Commissioner’s recommendation aimed at ensuring that the company’s anonymization process be independently reviewed and that Loblaw implement any required risk mitigation measures.