OTTAWA – The federal privacy commissioner has determined that Canada Post is violating the law by collecting information from the outside of envelopes and packages to create marketing lists that it rents to businesses. Philippe Dufresne, the privacy commissioner, has stated that the information gathered for this marketing program includes details about individuals’ residences and their online shopping habits, based on the senders of their packages.
The investigation revealed that Canada Post did not obtain proper authorization from individuals to indirectly collect such personal information. Dufresne’s report found this to be a breach of section 5 of the Privacy Act.
In response to the investigation, the commissioner recommended that Canada Post cease using and disclosing personal information in this manner until it obtains consent from Canadians. However, Canada Post disagreed with this conclusion and refused to take corrective action.
The case came to light when a man received marketing material from a Toronto restaurant with his name and full apartment address on the envelope, including the suite number. It was discovered that this material was sent through Canada Post’s Smartmail Marketing Program, which arranges mail campaigns for businesses.
Under this program, Canada Post works with mail service providers who prepare and send direct mailouts to customers. While not all campaigns include recipients’ full addresses, Canada Post’s marketing information indicates that people are more likely to open addressed mail than unaddressed mail.
Mail service providers are prohibited from disclosing mailing lists to advertisers and must safeguard the information, disposing of lists once a campaign is completed.
Canada Post claims it can generate marketing lists based on 1,200 available targeting attributes such as marital and family status, ethnicity, interests, and hobbies. The post office argued that it must find new ways to diversify its revenue streams as traditional mail volumes decline, and it believes that consumers enjoy receiving relevant marketing offers by mail.
The privacy commissioner disagreed, stating that not all Canadians would view the monetization of their personal information positively. Canada Post also argued that it already has permission to deliver mail to Canadian households and that asking for “re-permission” to deliver their mail would be unreasonable.
Additionally, the post office suggested that individuals could opt out of the program through the Canada Post website and that by not using the opt-out, people implicitly authorize the use of their personal information for the marketing program. The commissioner rejected these arguments.
As a result, the privacy watchdog recommended that Canada Post stop using and disclosing personal information for mail marketing activities without obtaining consent from individuals. Canada Post, however, declined this recommendation and instead pledged to improve the transparency of information on its website regarding the use of personal information, enhance the visibility of the opt-out mechanism, and provide a related brochure at its retail outlets.
The privacy commissioner acknowledged these efforts to improve transparency but maintained that they do not meet the requirement for obtaining authorization from individuals as mandated by section 5 of the Privacy Act.
In response to the report, Canada Post stated that it is exploring ways to better inform Canadians about how their mailing data is used while outlining their options.