Where I set the limits on what a retailer's data may do

I run Mirebrook Circle's data on the principle that membership, personalised offers and supplier advertising are three different agreements. Since 2023 members choose the second and third separately, and refusing either costs nothing in points or member prices. The harder discipline is inference. Front-store baskets in a pharmacy chain can reveal pregnancy, dependency or chronic illness, so we keep a register of 38 product categories that no personalisation model, supplier audience or segment report may use. Two pharmacists and our chief privacy officer review it with me, and the audit and risk committee approves it each year. Federal privacy law and the substantially similar private-sector laws of Québec, Alberta and British Columbia are interpreted by our privacy office, which owns that legal judgement. My part is building systems in which the cautious answer is the default and every new data use is mapped to the consent it relies on before any code is written.

Mirebrook's forecasting system produces about 41 million store-item forecasts a week, and I am responsible for its design and its measures. For most of the assortment, from cosmetics and fragrance to snacks and sun care, weighted forecast error is the right yardstick and our planners use it daily. For 212 essential health products, including children's fever medicine, oral rehydration salts, glucose test strips and allergy tablets, we measure something else: the share of store-days on which the product was on the shelf during the eight highest-demand weeks of each season. Those forecasts use all store sales rather than member sales alone, together with weather, school calendars and provincial respiratory illness reporting, and they are retrained before each season. I also own the allocation rule we apply when supply falls short, which the executive committee approved in 2023 so that nobody has to improvise one during a shortage.

Every loyalty programme gives different members different net prices through its offers, and I think that is defensible only within limits we state publicly. At Mirebrook personalised offers may only ever take a price below the posted shelf price. Offer models may not use signals of urgency, illness or a lack of nearby alternatives, such as late-night purchases, health-inference categories or the density of competing stores in a postal area. The 212 essential health products carry one price for everyone and receive promotions only through the flyer. Each quarter my team tests whether the value of offers differs by inferred need group, province or language of communication, and the results go to the executive committee. When a 2024 review showed members with likely chronic conditions were receiving smaller offers than comparable members, we removed the features responsible and accepted about C$6 million a year less incremental margin.

Suppliers pay retailers for sponsored placements and for evidence that the placements worked, and the evidence is where the data risk sits. I designed the Mirebrook Partner Network's clean room so that brands can measure campaigns and size audiences without ever receiving member-level records. Only members who have agreed to supplier advertising are included; outputs are aggregates of at least 500 households; nothing leaves as rows; the 38 health-inference categories cannot define an audience, even for the brand that makes the product; and the privacy office reviews query logs each month. A supplier that wants to match its own customer list must show that its consent covers the match. I negotiate these terms directly with larger suppliers because the commercial team, reasonably, wants fewer restrictions than I do. Since 2025 a pooled campaign option has given small Canadian brands results they could not obtain under the household threshold alone.

Shrink in a beauty and pharmacy chain comes from organised theft, refund and pickup fraud, internal loss and administrative error, and the analytics for each differ. I build loss analytics on transactions rather than on faces. We look for exceptions in refunds without receipts, voids, price overrides, online pickup claims and gift card activity, and we map loss by product and store to decide which items belong in locked fixtures or behind the counter. Three limits apply. Loyalty data is never used to compile a list of suspected customers. Biometric identification is not used in our stores. Requests from police for customer data go through our legal team, are answered only where the law requires or clearly permits disclosure, and are logged and reported to the audit and risk committee each year. Within those limits front-store shrink fell from 2.3% to 1.8% of front-store sales between 2023 and 2025.

A national chain with 173 stores in Québec holds every product, offer and consent notice in two languages, and the two versions drift unless someone owns them. Québec's language law requires French on product information and commercial communications, and our Québec members expect the French version to be complete rather than an afterthought. Until 2025 our product records were approved in English and translated afterwards, which left about 9% of front-store items with incomplete French descriptions at launch and slowed search in the French app. I am replacing that with a standard in which both language fields are mandatory at creation, owned by the category team rather than by translation, and checked automatically before an item can be sold. Consent wording is tested separately in each language with members, because a phrase that reads as neutral in English can sound more permissive in French, and the reverse.