Canadians trust major retailers with more than just their money we trust them with our data. That’s why the latest findings from the Privacy Commissioner of Canada regarding Staples Canada are deeply troubling, and frankly, unacceptable in 2026.
According to the federal privacy watchdog, nearly one in four returned laptops resold by Staples still contained personal information. Names, email addresses, account details, email fragments and even partial images of people’s faces were found on devices that should have been wiped clean. This wasn’t a one-off technical glitch. It was a systemic failure.
What makes this worse is that Staples has been here before. The company was audited in 2011 for similar issues, and yet, 15 years later, many of the same problems remain. That raises a serious question: how seriously are large retailers taking consumer privacy?
A Known Problem, Ignored for Too Long
The investigation began after a former Staples sales associate blew the whistle, alleging that laptops were not always properly wiped after being returned. In some cases, devices reportedly still displayed the previous owner’s username and password. In at least one instance, a laptop with unwiped personal data was actually resold to another customer.
This isn’t just careless it’s dangerous.
In an era of identity theft, phishing scams, and financial fraud, leaving personal data on resold devices exposes customers to real harm. A laptop isn’t just hardware; it’s a digital diary of someone’s life.
To its credit, the Privacy Commissioner has stepped in firmly, giving Staples nine months to: Establish clear and enforceable data-wiping standards, improve staff training and Hire an independent third party to conduct annual spot checks.
But the fact that such measures are still necessary after a previous audit is telling. Privacy protection cannot depend on internal shortcuts, rushed staff, or inconsistent procedures. It must be built into the system and enforced.
This case should concern anyone who has ever returned a device, traded one in, or bought refurbished electronics. It also sends a strong message to retailers across Canada: privacy negligence will eventually come to light.
For consumers, the lesson is equally clear. Never assume a retailer has fully erased your data. Log out, encrypt, reset, and, when possible, wipe devices yourself before returning them.
Staples Canada’s lapse isn’t just a corporate embarrassment it’s a reminder that in the digital age, privacy failures are not minor oversights. They are breaches of trust. And trust, once lost, is far harder to restore than any laptop ever could be.
