Returning a laptop to Staples in Canada also means handing over personal data in some cases, according to a government audit.

Canadian Staples stores are failing to fully wipe customer data off returned laptops and storage devices before reselling them, thus violating Canada's privacy laws, the CBC News reports.

More than a third of the 149 storage devices tested by the Office of the Privacy Commissioner of Canada, including laptops and USB hard drives, still had customer data on them--despite undergoing a wipe and restore process to be readied for resale. Some of the lingering information was reportedly pretty sensitive, including things like tax and ID records and passport numbers.

"Our findings are particularly disappointing given we had already investigated two complaints against Staples involving returned data storage devices and the company had committed to taking corrective action," commissioner Jennifer Stoddart said in a press release. "While Staples did improve procedures and control mechanisms after our investigations, the audit showed those procedures and controls were not consistently applied, nor were they always effective, leaving customers' personal information at serious risk."

The commissioner's office is following up its initial slap on the wrist with another slap on the wrist. It recommended that the office supply chain "implement enhanced controls to eliminate any risk of personal information being disclosed." The commissioner's office did not elaborate on those measures.

Responding to the audit findings, Staples said in the audit report that it is testing multiple methods of fully wiping data without damaging or destroying returned products.

Staples has until June 30, 2012, to submit a report to the Canadian government from an independent third party confirming that it has taken care of the problem. In the meantime, it's probably an especially good idea to format and wipe your own system before returning it--or running for public office.

The privacy commissioner's office says its stance is "...that if Staples is unable to remove all customer data from a particular manufacturer's device, it is unacceptable to resell that device."

There are more than 300 Staples stores in Canada.