Staples resold devices holding consumer data

Canada audit rips Mass.-based chain

June 22, 2011|By Jenn Abelson, Globe Staff

Canadian officials said Staples was previously told to correct resale… (Rick Bowmer/Associated…)

Staples Inc. has repeatedly put consumers’ data at risk in Canada by failing to wipe clean returned storage devices that contain sensitive information and are then resold.

Those findings were reported yesterday following an audit by the Office of the Privacy Commissioner of Canada. The audit included tests of storage devices, including computers, USB hard drives, and memory cards that had undergone a “wipe and restore’’ process and were destined for resale.

Of the 149 devices tested, 54 contained customer data, including “highly sensitive personal information’’ such as health card and passport numbers, academic transcripts, banking information, and tax records.

“Our findings are particularly disappointing given we had already investigated two complaints against Staples involving returned data storage devices and the company had committed to taking corrective action,’’ Canada’s privacy commissioner, Jennifer Stoddart, said in a statement. “While Staples did improve procedures and control mechanisms after our investigations, the audit showed those procedures and controls were not consistently applied, nor were they always effective — leaving customers’ personal information at serious risk.’’

In a statement, the Framingham-based office supply giant said it cooperated fully with the privacy commissioner’s office.

“Staples Canada takes privacy very seriously and works hard to protect our customers’ information. Just like technology, privacy standards and issues are evolving constantly,’’ the company said. “Staples Canada has implemented changes that we believe exceed current industry practice in Canada to remove personal data from returned memory devices.’’

The Office of the Privacy Commissioner has asked Staples to provide, by June 30, 2012, a report from an independent third party confirming how the company has complied with recommendations stemming from the audit.

Jenn Abelson can be reached at abelson@globe.com.