A REVIEW OF

THE LIQUOR CONTROL BOARD OF ONTARIO’S

PERSONAL INFORMATION COLLECTION PRACTICES

Order PO-3171

Table of Contents

Background

Liquor Control Board of Ontario (LCBO)

Legislative Context

Spirit, Beer and Wine Clubs

The Complaint

The Investigative Process

Issues and Discussion

Issue 1: Is the information in question personal information as defined in section 2(1) of the Act?

Issue 2: Is the LCBO’s collection of personal information in accordance with section 38(2) of the Act?

Summary of Findings

Order Provisions

BACKGROUND

The Office of the Information and Privacy Commissioner of Ontario (IPC) received a privacy complaint from the manager of a wine club, who was also a member of the wine club. The complaint involves the Liquor Control Board of Ontario (LCBO) and relates to the LCBO’s Business Process & Program Guidelines – Spirit, Beer or Wine Clubs (Club Guidelines) that apply to spirit, beer, and wine clubs. Specifically, the complainant objected to the collection of personal information about wine club members when the wine club places orders through the LCBO’s Private Ordering Department. The complainant believes that the LCBO’s practice of collecting this information is in violation of the Freedom of Information and Protection of Privacy Act (the Act).

Although the complaint received by my office was from a wine club, the LCBO’s policies regarding the sale of its products to wine clubs also apply to any liquor products purchased through spirit and beer clubs. For ease of reference, I will refer to spirit, beer, and wine clubs as clubs throughout this Order. Any findings or Order provisions that I make will apply to orders placed with the LCBO’s Private Ordering Department through all three of these types of clubs.

Liquor Control Board of Ontario (LCBO)

The LCBO is a Crown agency that reports to the Minister of Finance. It operates more than 630 retail liquor stores across Ontario. In addition to offering products for sale in its retail locations, the LCBO has a Private Ordering Department through which customers may purchase products that are not otherwise available in its stores. According to the LCBO, it is common for orders that are submitted through its Private Ordering Department to be from an intermediary, such as a manufacturer’s representative or clubs.

Legislative Context

Section 3(1) of the Liquor Control Act sets out the powers and purposes of the LCBO and states, in part:

The purposes of the Board are, and it has power,

(a) to buy, import and have in its possession for sale, and to sell, liquor and other products containing alcohol and non-alcoholic beverages;

(b) to control the sale, transportation and delivery of liquor;

…

(n) to do all things necessary for the management and operation of the Board in the conduct of its business;

The sale of alcohol products in Ontario is regulated by statute. Individuals and organizations are prohibited from purchasing liquor for resale by section 5 of the Liquor Licence Act, which states, in part:

1. (1) No person shall keep for sale, offer for sale or sell liquor except under the authority of a licence or permit to sell liquor or under the authority of a manufacturer’s licence.
2. (2) No person shall canvass for, receive or solicit orders for the sale of liquor unless the person is the holder of a licence or permit to sell liquor or unless the person is the holder of a licence to represent a manufacturer.

Under section 4.1(1) of the Liquor Control Act, the Chair of the LCBO may designate an inspector to determine whether there is compliance with the Liquor Control Act or the Liquor Licence Act. Section 4.1(1) states:

The Chair of the Board may designate any person as an inspector to carry out inspections for the purpose of determining whether there is compliance with this Act, the Liquor Licence Act, the Wine Content Act and the regulations under those Acts.

The powers of an inspector are set out in section 4.2(2) of the Liquor Control Act and include the power to enter the premises of, (i) a location at which liquor is sold, served, manufactured, kept or stored; or (ii) a location at which books or records relating to the sale, service, manufacture, or storage of liquor are kept or are required to be kept. Upon entry of the premises described above, and as set out in 4.2(3) of the Liquor Control Act, an inspector has the power to:

1. (a) inquire into negotiations, transactions, loans or borrowings of a licensee or permit holder under the Liquor Licence Act, a manufacturer, a person who imports liquor, a person authorized to operate a government store or any other person who is granted an authorization or is the subject of an appointment referred to in subsection 3 (2);
2. (b) inquire into assets owned, held in trust, acquired or disposed of by a licensee or permit holder under the Liquor Licence Act, a manufacturer, a person who imports liquor, a person authorized to operate a government store or any other person who is granted an authorization or is the subject of an appointment referred to in subsection 3 (2);
3. (c) request the production for inspection or audit of books, records, documents or other things that are relevant to the inspection;
4. (d) remove documents or things relevant to the inspection for the purpose of making copies or extracts;
5. (e) remove things relevant to the inspection that cannot be copied and may be evidence of the commission of an offence;
6. (f) remove materials or substances for examination or test purposes if the licensee, permit holder, manufacturer, importer or other occupant of the premises is given notice of the removal; and
7. (g) conduct such tests as are reasonably necessary for the inspection.

Spirit, Beer and Wine Clubs

Spirit, beer, and wine clubs are generally organizations that have been created by a group of individuals for a variety of purposes, which may include providing access to spirits, beers, and wines that are not normally available at LCBO retail stores; sharing knowledge of different liquor products; taking advantage of volume discounts offered by suppliers; and creating a social setting for the members of these clubs to learn about and discuss new products.

Given that section 5(2) of the Liquor Licence Act prohibits individuals and organizations from receiving or soliciting orders for the sale of liquor, the LCBO states that it has developed a policy to facilitate the placement of orders through its Private Ordering Department by clubs on behalf of their members.

LCBO policy requires that groups of individuals who wish to form clubs register and apply for approval to purchase their liquor through the Private Ordering Department. Once registered, these clubs can place orders on behalf of their individual members. A group wishing to register as a club may do so by letter to the LCBO, Retail Planning Department. Once the application for registration is received and reviewed, the LCBO will send a letter confirming registration and setting out the Club Guidelines which apply to the purchases made through the club.

The Private Ordering Department allows private individuals, registered and approved clubs, and manufacturers’ agents to order liquor products not usually available through the LCBO retail stores. The process for placing an order with the Private Ordering Department by clubs is set out in the LCBO’s Club Guidelines.

Under the Club Guidelines, the LCBO will accept orders from a club on behalf of its members for imported liquor, and will sell such products to club members through the club. Section 2 of the Club Guidelines states:

All beverage alcohol products ordered by the club must be purchased from the LCBO through the club by its individual members. The club may not maintain an inventory of such products for general availability to members and club members purchasing such products through the club must do so for their own consumption and may not resell the products to third parties. The club may not order products on behalf of persons holding licences to sell liquor issued by the Alcohol and Gaming Commission of Ontario.

The LCBO policy also states that it requires clubs to submit a purchase list for their orders, and that this list must contain the names, addresses and phone numbers of the members placing orders, and the precise details of what product and quantity is being ordered by each member.

Depending on the practices of a particular club it may, (i) take delivery of the orders on behalf of its members; or (ii) have its members pick up their orders directly from the LCBO. In the latter situation, the only way for the LCBO to confirm that the individual seeking to pick up the product is the one who ordered it, and to confirm that the customer is receiving the correct product and quantity of product ordered, is for the LCBO to ask for identification and proof of purchase.

The complainant does not have any concerns with the LCBO’s collection of personal information in circumstances where the member is picking up his or her order directly from the LCBO.

I accept that in these limited circumstances, the collection of personal information may be necessary to the administration of the LCBO’s business of selling liquor through the Private Ordering Department to clubs; without proof of purchase, including identifying personal information, it would not be possible to process this type of sale. Therefore, this Order will not discuss the situation described above where club members attend in person to pick up their orders from the LCBO.

At issue in this privacy complaint is the collection of club members’ information where orders are placed by the club on behalf of its members, and then picked up and distributed by the club to the members who placed them.

The Complaint

As noted above, the complainant operates a wine club in Ontario and has complained about the LCBO’s policy of collecting personal information about its members when the club places orders through the LCBO’s Private Ordering Department, on their behalf. The complainant submits that this collection of personal information by the LCBO is inconsistent with the Act and amounts to a collection of information about the members’ consumption habits. This complaint was filed after the LCBO refused to process an order placed by the complainant’s club because the complainant would not provide the LCBO with the requested personal information.

The complainant’s club is registered with the LCBO and it has received approval from the LCBO to purchase products through the Private Ordering Department. The registration process that is described above was completed in 2004 and was confirmed by letter dated October 15, 2004, from the LCBO to the complainant. The letter indicated that the complete details on placing an order by the club could be obtained through the LCBO Private Ordering Department.

The LCBO has stated that the requirement to collect the personal information of customers placing orders through clubs has been in place since the complainant’s wine club was registered with the LCBO in 2004. The LCBO acknowledges, however, that in the past, for reasons including administrative oversight, it has processed orders from the complainant’s club without requiring the personal information of individual members to be provided. The LCBO submits that regardless of past practice, the complainant’s club has been, and continues to be, required to submit the personal information of its customers when it places orders on their behalf. In this Order, I will not engage in a discussion about the possible reasons for the LCBO processing the complainant’s wine club orders from 2004, when it first became registered, until the fall of 2012. The sole issue here is whether the LCBO’s Private Ordering Department is entitled to collect personal information when it processes orders received from the clubs.

The complainant submits that club members are not afforded the same level of privacy as that provided to regular LCBO customers who purchase products at a retail store. The complainant states that many of the members order through the club in order to maintain their anonymity when making a special purchase, and he argues that club members are being treated differently than individuals making purchases in person at an LCBO retail store.

The complainant further submits that there is no justifiable reason why the LCBO must collect the personal information of every member who is placing an order through the club, whenever an order is placed.

In response, the LCBO stated that its practices regarding the collection of personal information do differ when a customer is making a purchase in person at a LCBO store. The LCBO submits that it has processes in place to handle situations where staff have concerns that a retail store purchase may, in fact, be a third party purchase for the purpose of resale.

The Investigative Process

Upon receiving this complaint, my office launched an investigation to determine whether the personal information of club members was being collected by the LCBO in compliance with the Act.

As part of my office’s investigation into this complaint, we spoke with senior management at the LCBO and received and reviewed a number of documents, including the LCBO Customer Privacy Policy, LCBO Private Ordering Program Guidelines, and the LCBO Club Guidelines.

During the course of our investigation, the complainant and the LCBO were invited to submit additional comments on the issues raised in this investigation. Throughout this entire investigation, my office received the full cooperation of both the LCBO and the complainant.

ISSUES AND DISCUSSION

The issues raised by this complaint are:

1. 1. Is the information at issue personal information as defined in section 2(1) of the Act?
2. 2. Is the LCBO’s collection of personal information in accordance with section 38(2) of the Act?

Discussion

Issue 1: Is the information in question personal information as defined in section 2(1) of the Act?

The issue I must initially determine is whether the information collected qualifies as personal information within the meaning of the Act.

Section 2(1) of the Act states, in part, that personal information means recorded information about an identifiable individual including:

(d) the address, telephone number, fingerprints or blood type of the individual,

…

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

As noted above, the information collected by the LCBO when orders are placed by a club through the Private Ordering Department include the names of customers, their address, telephone number, and the product name and quantity of the liquor they are purchasing.

There is no dispute that the information in question satisfies the requirements of the definition of personal information contained in paragraphs (d) and (h) of section 2(1) of the Act. Having reviewed the documentation, I find that the information collected and stored by the LCBO when processing club orders qualifies as personal information.

Issue 2: Is the LCBO’s collection of personal information in accordance with section 38(2) of the Act?

Section 38(2) of the Act addresses the collection of personal information and imposes a prohibition on the collection of personal information, subject to three limited circumstances. It states:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

In order for a particular collection practice to be consistent with the Act, the institution must show that the collection of personal information is either, (1) expressly authorized by statute; (2) used for the purposes of law enforcement; or (3) necessary to the proper administration of a lawfully authorized activity.

The LCBO submits that the collection of personal information relating to club orders is in compliance with the Act because it is necessary for the purpose of administering the spirit, beer, and wine club program.

In Privacy Investigation Report MC07-68, the Investigator found that the onus is on an institution to first identify the lawfully authorized activity and second, to demonstrate why the collection of personal information is necessary and not merely helpful, to the proper administration of the activity.

This approach was upheld by the Ontario Court of Appeal in Cash Converters Canada Inc. v. Oshawa (Cash Converters),¹ where it considered the equivalent of section 38(2) in the Municipal Freedom of Information and Protection of Privacy Act (section 28(2) of the municipal legislation). The Court approved the approach used by my office to assess an institution’s collection of personal information, which is …to examine in detail the types of information being collected and to determine whether each type is necessary for the collecting institution’s activity. In Cash Converters, the Court of Appeal stated that the Act’s use of the term necessary requires that the personal information collected must be more than merely helpful to an activity, and if the purpose of the collection may be achieved by other means, then the institution is required to opt for the alternative.

Taking the same approach, I will first consider whether the LCBO was engaged in a lawfully authorized activity and then whether the collection of the personal information was indeed necessary to that activity.

Was the LCBO engaged in a lawfully authorized activity within the meaning of section 38(2) of the Act?

The LCBO has submitted that the collection of personal information in the context of sales of liquor through clubs directly relates to its authority to sell and control the sale of liquor in Ontario, and to properly manage and administer the Board.

The LCBO specifically relies on section 3(1)(n) of the Liquor Control Act to justify its collection of the personal information in question. The LCBO submits:

The personal information collected is necessary to the proper administration of a lawfully authorized activity. This activity is the establishment and operation of Spirit, Beer and Wine Clubs, including their registration, product ordering and distribution through the LCBO retail network.

I accept that the LCBO has the legal authority pursuant to section 3(1) of the Liquor Control Act, to sell liquor to clubs, and to establish policies and procedures relating to these sales and, therefore, in doing so the LCBO is engaged in a lawfully authorized activity.

Was the LCBO’s collection of the club members’ personal information necessary to the proper administration of the activity within the meaning of section 38(2) of the Act?

The LCBO submits that it collects the minimum personal information necessary to process private orders by a club through its Private Ordering Department. In its submissions, the LCBO states:

…the information collected is the minimum necessary to meet the purpose for which it is collected and that the proper administration of a lawful activity (the processing of orders for liquor products that are submitted on behalf of club members) is not possible without that information.

It states that it does not compile aggregate information on the consumption or purchase habits of any individual, and that none of the information collected is used by the LCBO for marketing purposes or for the purposes other than as set out in its response to our request for information.

The LCBO states that the collection of the personal information of club members is necessary to:

1. 1. process the transaction;
2. 2. facilitate the recall of products if a defect is discovered;
3. 3. enable audits of the operation of the program; and
4. 4. deter fraud generally, and to deter the use of these types of sales by intermediaries for the illegal resale and illegal stockpiling of liquor.

In its submissions, the LCBO states that these purposes are sufficiently important to warrant collecting the personal information about individual club members who place orders through clubs.

Processing the transaction

The LCBO has submitted that the collection of personal information is necessary to ensure the orders of club members are fulfilled in those cases where the club does not, or is unable to, fulfill the order placed by the member and to facilitate the processing of a refund. It states that as a high profile public enterprise, it often finds itself held to a higher standard than other retail businesses. The LCBO submits that if there were a problem with a wine club not fulfilling an order or in processing a refund, there would be a public expectation that the LCBO solve the problem quickly and to the satisfaction of the club members. This might occur, for example, where the club has absconded with funds or failed to pay for orders or stolen the alcohol purchased with members’ money.

In addition, the LCBO submits that by collecting the personal information of club members, it can ensure some transparency with respect to the transaction. For example, it states that it is not uncommon for LCBO staff to be asked about the details relating to cost and billing, and customers are sometimes shocked to learn how much of the cost to them is made up of the club’s service fee.

Having considered these representations, I am not convinced that the collection of the personal information of club members is necessary for processing transactions. In most of the instances referred to by the LCBO, the customer, who has entrusted his or her funds to the club, would have complete recourse through the wine club management to address their concerns. In the case of a refund, there is no reason why that could not be processed through the club. I note that the LCBO has not provided any evidence regarding the number of times that it has had to use the personal information of club members to fulfill orders or process refunds. I further note that the LCBO has worked with the club since 2004 without obtaining this information.

Similar to the circumstances involving unfulfilled purchase orders, while it may be helpful for the LCBO to be able to address customer’s questions regarding costs, the customer has the ability to pursue any issues about the costs of the purchase directly with the club. Club members have chosen voluntarily to join a club, and would certainly feel free to question the actions of their club. Further, the LCBO can provide club members, on request, with the price charged by the LCBO to the wine club. This would allow members to calculate any additional service fee. Although I commend the LCBO for its good intentions and its desire to protect the members’ interests, I am not persuaded that this factor is sufficient to support a finding that the collection of personal information is indeed necessary.

Facilitating the Recall of Defective Products

Products in all categories of consumer goods, including those regulated by the government, may be recalled from time to time because a defect is discovered. The LCBO submits that it is necessary to collect members’ personal information to facilitate contacting them in the event that a product has been recalled. The LCBO states that, where products are sold in retail locations, it can reasonably rely on notices posted in stores and media alerts to inform customers who have purchased the recalled products. The LCBO submits that for recalled products purchased through the Private Ordering Department, store notices may not be effective and the media has less interest in disseminating information if the amount of liquor purchased is relatively small, as is often the case for club orders. The LCBO states that relying on the clubs to contact their membership is not an adequate alternative because the club may have gone out of business, members may have moved or left the club or the club may be unwilling to spend the time and effort to notify members and former members.

The LCBO also states that some of the products may be cellared for years and the need to notify customers may arise long after the sale. It adds that some products may have been originally found to be safe for consumption, but chemicals accumulated over time may cause defects which make the product unsafe.

The LCBO notes that ensuring food safety is a matter of broader societal concern and refers to its obligations as the importer of record and the seller of the product under the new Safe Food for Canadians Act, which it states provides for better control over food imports, strengthens food traceability requirements and implements tougher penalties for activities which put health and safety at risk. It states that this new legislation has heightened the need for the LCBO to have an effective recall process to meet safety standards.

I recognize the importance of communicating to customers that a recall for a product is in place. I also recognize that it may not be possible or appropriate to rely upon a club to notify its membership for a number of the reasons identified by the LCBO. However, I also note that in some cases, given the passage of time from the date of sale and the date of the recall, any address and contact information provided by club members at the time of the sale, may not be valid. This same address and contact information may no longer be relevant in cases where the product has been subsequently and legally resold at auction or been provided as a gift to a third party. Therefore, even if the LCBO collected the personal information of club members, based on the information provided, there are still numerous instances where it would not be able to rely on that information to process a recall.

In light of these circumstances, the LCBO, along with any other sellers of consumer goods, has a variety of options available to process a recall. While I agree that working with the club may not be appropriate in all cases, this could be one part of a larger communication strategy. The LCBO could also issue a press release or post a notice of the recall in print media, on its own website, or in other online media. The existence of the recall could also be communicated through radio and television media outlets, and through in-store communications.

In light of the alternatives available to the LCBO, I am not satisfied that the collection of personal information for this purpose is more than merely helpful to the administration of its activities.

Enabling Audits

The LCBO submits that it collects the personal information of club members to enable it to conduct spot audits to determine whether the club has, in fact, placed the order on behalf of an actual customer, or whether the club is stockpiling alcohol with a view to an illegal resale. It also states that the ability to audit the sales is aimed at ensuring the effective and efficient operation of the department and to ensure that orders facilitated by the clubs are fulfilled. It also provides a check against fraud and the misuse of this sales channel by LCBO employees.

In its confidential representations, the LCBO referred to 12 companies that were charged between 2002 and 2005 with violations of the Liquor Licence Act, for stockpiling wine by submitting orders with fictitious end customers.

The LCBO acknowledges that it does have a number of additional ways of deterring this type of fraud which do not require the collection of personal information. However, it states that these measures are not as direct or effective as the check provided by confirming orders with customers. I will not set out the details of these other measures in this Order for reasons of confidentiality.

Correspondence provided to our office from the Assistant Deputy Minister, Revenue Agencies Oversight Division of the Ministry of Finance, supports the LCBO’s position in this complaint. The Assistant Deputy Minister states:

The LCBO is accountable for taking precautions to prevent clubs and other intermediaries from operating as unauthorized – and therefore illegal – retailers of alcohol by purchasing and reselling…The ability to verify that there are actual customers for all private order sales depends upon the collection of contact information from these customers.

….

LCBO revenues generated from its sales, including those through the Private Order Department, are an important source of revenue for the province. The Ministry expects the LCBO to take prudent measures to protect these revenues that help fund spending on health care, education and other key government priorities. These are matters of societal concern which, I believe, justify the collection of the required personal information.

Although I understand that having personal information on hand would facilitate the process of LCBO staff conducting audits and would therefore be helpful, I am not satisfied that it is necessary to collect customers’ personal information for this purpose. My reasons are set out below.

I have not been provided with any information or evidence regarding the scope of the problems that these proposed audits are designed to address. Specifically, although fraud and the resulting loss of revenue are identified as issues, the LCBO has failed to quantify this problem other than by reference to 12 companies charged between 2002 and 2005. Similarly, apart from advising me of the purpose of the audits of sales to clubs through the Private Ordering Department, I have not been provided with any information as to the frequency with which these audits have been conducted. Nor have I been provided with any information as to the results of any audits on clubs that have been conducted in the past.

I note that section 4.1(1) of the Liquor Control Act gives the LCBO the power to appoint inspectors to conduct inspections under the Liquor Control Act and the Liquor Licence Act. These powers give the LCBO the authority to investigate allegations relating to the illegal resale of liquor and other violations of the Liquor Control Act and the Liquor Licence Act.

I also note, as was acknowledged by the LCBO, that illegal reselling and stockpiling is a matter that can be investigated by the Alcohol and Gaming Commission of Ontario under the Alcohol and Gaming Regulation and Public Protection Act, 1996. Section 3 of that act gives the Alcohol and Gaming Commission of Ontario the responsibility for the administration of the Liquor Licence Act, and the regulations made under that Act, among other things. As noted by the LCBO, the police also have the authority to take action in relation to fraud and the illegal reselling and stockpiling of liquor.

In addition, I see no reason why any audits that operate as a check against employee fraud and employee misuse of the sales channel cannot be done with the assistance of the clubs that have a vested interest in ensuring that their membership receive the products ordered, and in ensuring that the membership does not pay more for the products than appropriate.

Having regard to the limited evidence and information provided regarding the need for this personal information to conduct audits, and in light of the powers that the LCBO already has under the Liquor Control Act to conduct inspections, I am not satisfied that the collection of the personal information for audit purposes is more than merely helpful to the administration of the Private Ordering Department’s sale of liquor products to clubs.

Deterring Fraud and Illegal Activity

The LCBO submits that one purpose for collecting personal information relating to club sales is to deter fraud, and the illegal resale and stockpiling of liquor by intermediaries. It states:

Given the LCBO’s statutory role in regulating the sale of liquor products, the LCBO attempts to prevent the sale of liquor products to a party in circumstances where it appears that the party is acquiring liquor products for resale. Accordingly, the LCBO Private Ordering Department attempts to distinguish between legitimate orders submitted by an intermediary (i.e., orders that are submitted by an intermediary such as a manufacturer’s representative or a wine club as agent on behalf of genuine end customers) and orders that do not appear to be legitimate (i.e., orders for products for which there is no end customer at the date the order is submitted to the LCBO).

For example, it has stated that all club orders are required to be made by the case and that it is illegal for clubs to pool the orders of their members, thereby permitting multiple customers to share one case. The LCBO has expressed concern that clubs might place orders for cases of liquor and then break up the cases to enable its members to purchase individual bottles from that case.

The LCBO has stated that of greater concern than the possibility of clubs breaking up cases of alcohol, is the potential for the illegal resale of liquor ordered through the Private Ordering Department. The LCBO states that one of the ways it deters this type of fraud and illegal activity is by requiring clubs to provide it with the personal information of the members for whom the club is ordering.

The LCBO submits that there have been cases in the past involving the illegal stockpiling or warehousing of liquor. The LCBO states:

There is a history of intermediaries such as agents being sanctioned by the AGCO (Alcohol and Gaming Commission of Ontario) for violations of the Liquor Licence Act involving illegal warehousing of wine. The LCBO believes the stockpiled wine was obtained by submitting orders with fictitious end customers to the LCBO Private Ordering Department with the intention of reselling the wine obtained.

As noted above, the LCBO provided my office with the names of 12 companies that were sanctioned in the period of 2002-2005 by the Alcohol and Gaming Commission of Ontario regarding the illegal stockpiling of wine. None of these examples involved clubs.

The LCBO states that the risk and impact of fraud through the private ordering sales channel is substantial. In support of this position, the LCBO has also provided my office with confidential information and scenarios that illustrate how this sales channel might be used to facilitate fraud.

With respect to the impact of fraud, it states that approximately 52 per cent of the final selling price of wine ordered through the LCBO private ordering channel is provincial revenue. Last year private ordering sales, leaving aside import draught beer which is not at issue in this complaint, totaled about $100 million, thereby generating provincial revenues of approximately $52 million.

It also states that:

By its nature, this type of illegal activity is difficult to quantify with certainty. …. As noted earlier, a number of intermediaries have been sanctioned by the AGCO for activities related to abuses of the Liquor Licence Act indicating that these abuses were not isolated instances.

The Ministry states in its correspondence:

I have reviewed the LCBO’s response to the complaint. The Ministry of Finance shares the view that collecting personal information as part of wine club orders is reasonable and consistent with LCBO’s legal mandate and business needs.

LCBO revenues generated from its sales, including those through the private ordering department, are an important source of revenue for the province. The ministry expects the LCBO to take prudent measures to protect these revenues that help fund spending on health care, education and other key government priorities.

I have carefully reviewed the LCBO’s response to our request for information and in the course of doing so, I have been mindful of the LCBO’s position relating to the difficulty of quantifying the impact of fraud and the potential risks of fraud in these circumstances. For the reasons set out below, I find that the LCBO has not established that the collection of personal information of club members using the private ordering sales channel is more than merely helpful at deterring fraud and protecting provincial government tax revenues generated by these sales.

As discussed above, the LCBO has not provided me with any substantive information to demonstrate that fraud is a significant problem in the context of the use of the Private Ordering Department by clubs. The evidence that is referred to above relates to the use of this sales channel by manufacturers’ agents, who are appointed by a liquor manufacturer to promote the manufacturer’s interest in its products in Ontario.

I commend the LCBO for setting out the means, other than through the collection of personal information, that are available to deter and detect fraudulent transactions. However, I disagree that the collection of personal information is the most effective means, greater than all the others. In fact, examples of the 12 companies charged with violations of the Liquor Licence Act clearly illustrate that the collection of personal information is not the most effective means.

As set out above, manufacturers’ agents are licenced and required, when placing orders with the LCBO on behalf of customers, to provide contact details and order purchase details of their customers. These organizations have been required by regulation to be licenced and have been required to provide customer information to the LCBO when placing orders on behalf of other individuals or organizations, or in other words, as an intermediary in a third party transaction, since 1996.² Therefore, between 2002 and 2005, when the 12 companies were caught having violated the Liquor Licence Act, the LCBO was collecting information about the agents’ customers. In light of this, I am left with the conclusion that if the collection of the personal information about customers was aimed at deterring fraud, it appears not to have been successful in these cases.

If the LCBO does suspect fraud, under section 4.1(1) of the Liquor Control Act, the Chair of the LCBO may also designate an inspector to determine whether there was compliance with the Liquor Control Act or the Liquor Licence Act. Instead of collecting the personal information of club members at the time of purchase, in appropriate circumstances, an inspection or audit of the club’s purchases could be conducted to ensure that the club was not engaging in third party purchase transactions.

In my view, the LCBO has not provided my office with much more than anecdotal or hypothetical evidence to support its position that the illegal resale of liquor by wine clubs in this province is so problematic that it necessitates the collection of the personal information of club members who purchase wine through their clubs. Having regard to the other means available to the LCBO to deter and detect fraud, even if this were an issue of great concern, collection is not necessary for this purpose. While I acknowledge that any illegal resale of liquor would result in potential revenue loss to the province, without any evidence that this is actually occurring and on a significant scale, I am unable to find that the collection of personal information relating to spirit, beer, and wine club purchases is necessary for the operation and management of the LCBO’s club purchasing program.

In summary, I am not satisfied that the LCBO has established that the collection of the personal information of wine club members purchasing wine through its private ordering sales channel is necessary to the proper administration of the lawfully authorized activity. The LCBO has not persuaded me that it is necessary to collect this information to ensure that a transaction is fulfilled, to facilitate the recall of products, enable audits or to deter fraud. Therefore, with the exception of those circumstances where a club member has arranged to personally pick up his or her order at the LCBO, I find that the LCBO’s collection of personal information relating to club orders is not consistent with section 38(2) of the Act.

SUMMARY OF FINDINGS

I have made the following findings in this investigation:

1. 1. The information being collected by the LCBO qualifies as personal information under section 2(1) of the Act.
2. 2. The LCBO’s collection of the personal information of spirit, beer, and wine club members when processing purchase orders submitted by these clubs on their behalf, except in those circumstances where an individual member intends to pick up the products ordered, contravenes section 38(2) of the Act.

ORDER

When I conclude that personal information has been collected in contravention of the Act, my remedial powers are set out in section 59(b), which reads:

The Commissioner may,

(b) after hearing the head, order an institution to,

(i) cease collection practices, and

(ii) destroy collections of personal information,

that contravene this Act;

Based on these powers, and my findings set out above, I order as follows:

Cease Collection

1. I order the LCBO to cease collecting the personal information of spirit, beer, and wine club members when processing purchase orders submitted by these clubs on their behalf, except in those circumstances where an individual member intends to pick up the products ordered.

Destruction

2. I order the LCBO to destroy all personal information that has been collected from spirit, beer and wine club members when processing purchase orders submitted by these clubs on their behalf, except in those circumstances where an individual member made arrangements to pick up the products ordered.

3. In order to verify compliance with this Order, I require the LCBO to provide me with proof of compliance by May 28, 2013.

Original signed by: Ann Cavoukian, Ph.D. Commissioner

February 27, 2013

---

¹ Cash Converters Canada Inc. v. Oshawa (City), 2007 ONCA 502.

² Liquor Licence Act, R.R.O. 1990, Regulation 718, section 2.1(3)