The 1,759 Things I Bought from Sobeys

Last month I requested and received data about my use of my Air Miles card in an access request to the company that manages the program. One of the things I learned from analyzing the data I received is that my most frequent use of my Air Miles card was at Sobeys, the grocery store where I do most of the weekly grocery shopping for our family.

This begged the question: what additional information about me does Sobeys itself hold.

And thus my next access request: following the guidelines here, I sent the following request to Sobeys’ Privacy Officer:

Under the provisions of the Canadian Personal Information Protection and Electronic Documents Act, I would like to request a copy of personal information held by Sobeys Inc. and its direct and indirect subsidiaries, parents and affiliates about me.

Please advise as to the following:

1. Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases.

a. In particular, please tell me what you know about me in your information systems, whether or not contained in databases, and including e-mail, documents on your networks, or voice or other media that you may store.

b. Additionally, please advise me in which countries my personal data is stored, or accessible from. In case you make use of cloud services to store or process my data, please include the countries in which the servers are located where my data are or were (in the past 12 months) stored.

c. Please provide me with a copy of, or access to, my personal data that you have or are processing.

2. Please provide a list of all third parties with whom you have (or may have) shared my personal data.

3. If you are additionally collecting personal data about me from any source other than me, please provide me with information about that source.

4. Please advise how long you store my personal data, and if retention is based upon the category of personal data, please identify how long each category is retained.

5. I would like to know whether or not my personal data has been disclosed inadvertently by your company in the past, or as a result of a security or privacy breach.

I sent this request on March 19, 2018 and I received back a reply today.

Here is Sobeys’ response to my queries, question by question:

Please confirm to me whether or not my personal data is being processed. If it is, please provide me with the categories of personal data you have about me in your files and databases.

Name – (Peter L Rukavina)

Email address – (peter@rukavina.net) - we have a record of your email address associated with opt-outs of our online communications known as “Better Food News” and “Sobeys eFlyer” on January 25, 2015, and opt-out for our discontinued Club Sobeys communications program on September 9, 2013.  Your email address will be retained indefinitely on a list of unsubscribed emails to ensure that no communications are sent to your email address in the future unless you opt in to a communication at a later date).

Date of Birth  - (April 5, 1966)

Home Address – (100 Prince Street, Charlottetown PEI, C1A 4R4)

Transaction data back to December 8, 2015 – we have transaction data in our system which is attributed to your Air Miles number – this data indicates your purchases for transactions where you displayed your Air Miles card. Here is a sample of the data; we can make the full file available to you upon request.

Please provide a list of all third parties with whom you have (or may have) shared my personal data.

We receive information from LoyaltyOne, Co., which administers the Air Miles program, and share your name and email address with our email communications agent, Inbox Marketer Corporation; we also share your name and home address with our direct mail agent, Transcontinental Printing Inc. Both of these shares are for the purposes of sending Air Miles co-branded offers.  Inbox Marketer Corporation also has your email address on a do not contact list for the purposes of the communications we set out above.  Our contracts with these third party providers contain strict privacy protection provisions and expressly prohibit them from using your personal information for any purpose other than as directed by us.

If you are additionally collecting personal data about me from any source other than me, please provide me with information about that source.

We are not collecting personally identifying information about you from any other source.

Please advise how long you store my personal data, and if retention is based upon the category of personal data, please identify how long each category is retained.

Your name and email address would be stored for the duration of your active consent to any of our electronic communications; should you opt out of any of our electronic communications, your email address would be stored indefinitely on a do-not-contact email list. Information received pursuant to your enrollment in the Air Miles program will be retained so long as you remain an Air Miles member; the transaction data related to your purchases in our stores where you show your Air Miles card is kept for 27 months.

I would like to know whether or not my personal data has been disclosed inadvertently by your company in the past, or as a result of a security or privacy breach.

We are not aware of any breaches of any of your personally identifying information.

The privacy officer included an additional note, which shows both good humour and attention to detail:

We note of course that all of the information referred to herein is also now on our email servers for the purpose of responding to your request. Data in our email servers is kept for up to 7 years.

I followed up with a request for the “transaction data in our system which is attributed to your Air Miles number” that was offered, and a few hours later I received a password-protected Excel file (with the password under separate cover) containing information about every product I’d purchased from Sobeys (or its Needs-branded convenience stores) from December 8, 2015 up to and including the day of my access request.

I loaded that Excel file into LibreOffice, converted the date column to YYYY-MM-DD, and exported it as a CSV file. There is data there on the 1,759 products I purchased  over 82 visits to the store over 850 days. That’s an average of one visit every 10 days.

What I Purchased

Using the Pivot Table feature of LibreOffice, I summarized the data by product.

I purchased 431 individual products on those visits; the 10 most frequently-purchased products were:

1. Purity Milk Homo 3.25% MF
2. Dorset Muesli Simply Nutty
3. Avocados Hass Large West
4. ADL Butter Salted
5. Oasis Juice P/AplBan-Orng
6. Comp Water Sparkling Original
7. Liberty Yogourt Blueberry Org
8. Comp Water Sparkling LemonLime
9. Oasis Juice Tropical Passion
10. Comp Jumbleberry Blend

Breakfast accounts for most of that (milk for coffee, muesli and yogurt, juice for Oliver), which makes sense as I buy a lot of what we eat for supper at the Charlottetown Farmers’ Market or at Riverview Country Market.

By dollar value rather than quantity the top 10 is a little different:

1. Dorset Muesli Simply Nutty
2. ADL Butter Salted
3. CntrlRst Almnd Dry Roasted Uns
4. Bagel Montreal Style Sesame
5. Purity Milk Homo 3.25% MF
6. Liberty Yogourt Blueberry Org
7. Sensatns Cheese Swiss Slices
8. Just Us Italian Roast Wh/Bean
9. NatClean Hand Soap Liq P/Mint
10. Comp Jumbleberry Blend

Where I Shopped

I do the weekly grocery shop at Sobeys on Allen Street in Charlottetown (which they call their “University Avenue Store”), so it’s no surprise that’s where most of my transactions happened. In order of dollars spent, the stores I shopped in were:

1. Sobeys University Avenue Store
2. Sobeys Babineau Drive
3. Foodland Charlottetown
4. Sobeys Stratford Store
5. Truro Highway 102 Needs
6. Charlottetown Euston Street Needs

How Much I Spent

Over those 82 visits to Sobeys I spent $8,111, or an average of $98 a visit, which sounds about right given what I’m used to paying every week at the checkout.

The least expensive thing I purchased was ginger root, for 56 cents.

The most expensive item was 51 of something listed only as “UNKNOWN PRODUCT FROM PRODUCT_FACT” from the Needs in Mount Albion; I suspect that this was 51 litres of gasoline.

The price of pound of ADL butter ranged from $4.99 to $6.00 over this period; the price of 2 litres of 3% Purity Dairy milk ranged from $3.39 to $3.79 (or $4.45 at the Needs convenience store).

What More Can I Learn?

With some additional post-processing–dividing products into categories, for example–I’m sure I could learn more: if you’re the curious and/or helpful type, you’re welcome to grab the data file and contribute your own analysis (a reminder that everything posted in this space, as outlined here, here is covered by a Creative Commons Attribution-NonCommercial 4.0 International License).