Skip Navigation

Alberta IPC Finds Business Failed to Protect Personal Information

Bookmark and Share

Monarch Beauty Supply, a beauty trade company with operations across the USA and Canada improperly disposed of 2,606 customer credit and debit card sales receipts by placing them in an unlocked dumpster. These receipts were stolen and (in at least one case) used to commit fraud.

In early September, 2005, the Edmonton Police Service (EPS) notified the Office of the Information and Privacy Commissioner (OIPC) that documents containing personal information from the Monarch Beauty Supply store in west Edmonton were turned over to EPS by a confidential informant. The documents included the store's daily financial records, customer credit and debit sales receipts containing customers' names, credit card numbers, expiration dates, customers' signatures, and debit card numbers.

The investigation into the incident by the Alberta Information and Privacy Commissioner found that Monarch Beauty Supply failed to protect personal information in their custody and made the following recommendations:

  • Notify all Edmonton based customers of the security breach and provide assistance
  • Develop new security and disposal policy and procedures
  • Conduct privacy and security training/awareness for employees
  • Implement more rigorous safeguards, and regularly monitor the effectiveness of these safeguards

Like the incident in LA two months ago, casual disposal of personal information has been linked to mass notification orders. This trend will no doubt be getting the attention of legal council on both sides of the 49th Parallel.

Monarch Beauty Supply cooperated fully with the investigation and implemented these recommendations.