EDMONTON - An Edmonton beauty supply shop failed its customers by allowing personal credit and debit information to end up in criminal hands, Alberta's Information and Privacy Commissioner's office said Wednesday.
Privacy officials said Monarch Beauty Supply improperly threw out more than 2,600 sales receipts at its west-end store with customers' credit and debit card numbers when it tossed them into an unlocked dumpster.
"Dumpsters are becoming favourite haunts for people who are looking for this kind of information who can use it for fraudulent purposes or sell it on the street," said Elizabeth Denham, the office's Personal Information Protection Act director.
The Information and Privacy Commissioner's office launched its investigation into Monarch's security practices last fall after Edmonton police alerted them to the problem. According to the privacy office's report released Wednesday, the problems stem from April 2005 when the store cleared out several documents before doing inventory.
Those records, including receipts and daily sales logs, ended up in a dumpster. A confidential informant "well-placed" within the criminal community handed the Edmonton police a bundle of Monarch receipts that same month.
Police received a second bundle in June and found more Monarch receipts with criminal suspects in August and October.
EPS alerted the Information and Privacy Commissioner's office to the finds in September. A woman also complained to the office after she discovered a $500 laptop computer purchase on her credit card bill. The EPS told her a few weeks later that a criminal had used one of her credit card sales receipts from Monarch to buy the computer.
Alberta's Personal Information and Protection of Privacy Act requires all organizations, including businesses, to take reasonable steps to safeguard people's personal information.
Officials from Monarch and its parent company could not be reached for comment on Wednesday. But Denham said the company co-operated with her office's investigation.
"They have made all kinds of process changes to reduce the risk of this happening again," she said.
For example, the company promised to buy equipment to obscure debit and credit card numbers on receipts and issue receipts only to customers. In the past, the store also kept a copy of each receipt.
Daily logs and records will be kept in locked storage containers and all record shredding will be logged.
Monarch also sent a letter to all of its Edmonton customers alerting them to the problem and telling them what they can do to protect themselves.
Denham said other companies need to learn from Monarch's mistakes.
The provincial office is investigating 15 similar cases, she said.
"This is an educational report because there are many, many businesses who are not properly safeguarding customer information and it is a consumer concern," Denham said.