Canada Post said Friday it is reviewing how it uses data for tailored marketing campaigns after the federal privacy watchdog found the post office was breaking the law by gleaning information from the outsides of envelopes and packages.
Privacy commissioner Philippe Dufresne said in a report released this week that information collected for the post office's Smartmail Marketing Program includes data about where individuals live and what type of online shopping they do, based on who sends them parcels.
The information is then used to help build marketing lists that Canada Post rents to businesses.
The commissioner found Canada Post had not obtained authorization from individuals to indirectly collect such personal information, a violation of Section 5 of the Privacy Act.
He recommended Canada Post stop the practice until it can seek and obtain consent from Canadians.
Dufresne's report said the post office disagreed with his conclusion and declined to take the corrective action.
The post office shifted course Friday, saying in a statement it understands the public might have concerns and that it will live up to the standards that Canadians expect.
"We are trusted to handle Canadians' personal information every day. There is nothing more important to us than maintaining that trust with Canadians."
Canada Post said it is committed to the privacy law and the protections it places on personal information, and will therefore conduct a review of its data services program.
Dufresne's office began its investigation following a complaint from a man who received marketing material from a Toronto restaurant with his name and full apartment address on the envelope, including the suite number.
Under the marketing program, Canada Post engages mail service providers that prepare and send direct mailouts to customers. Although not all campaigns include recipients' full addresses, post office research indicates people are more likely to open addressed mail than unaddressed mail.
Dufresne's report said Canada Post had argued that it has the permission of Canadian households to deliver mail to their addresses, and to request "re-permission to deliver their mail would be absurd.''
The post office also suggested that individuals could opt out of the program via the Canada Post website and, in not using the opt-out, people implicitly authorize the use of their personal information for the marketing program.
The commissioner rejected these arguments.
Canada Post said Friday that while its internal review proceeds, it will take greater steps to increase transparency and awareness of its approach, while streamlining and providing greater visibility for its opt-out programs.
"Through it all, we will continue to work closely with the Office of the Privacy Commissioner."
Dufresne's office said Friday that it takes note of Canada Post's commitment to review its data services program following the findings of the commissioner's investigation.
It added, however, that the commissioner's expectations for an appropriate remedy are set out in his report, and "we look forward to hearing the measures proposed by Canada Post to ensure that the privacy of Canadians is protected in accordance with the Privacy Act."
