Data breaches are making headlines and Canadians seem more concerned than ever about identity theft and credit card fraud. Businesses have a legal obligation to ensure that they develop and implement comprehensive plans to protect the personal information with which their customers entrust them, including credit card information that can quickly be exploited, but which is all-toofrequently freely available on credit card receipts. There is no legal requirement to mask or truncate credit card numbers from receipts and such plans can play an important role in preventing identity theft and the costs and disruption associated with data security breaches, as well as protecting a business’ reputation.

type Privacy and Access to Information Alert - October 2008 - Personal Information on Credit Card Receipts: An Overview of the Obligations of Business