Office Of The Privacy Commissioner Of Canada Finds Canada Post Collected Personal Information For Marketing Program Without Authorization

On September 19, 2023, the Office of the Privacy Commissioner of Canada (OPC) released the results of its investigation into whether Canada Post’s collection of personal information located on the outside of delivered envelopes and parcels for use in its marketing program violated the Privacy Act (the Act).  The OPC found that Canada Post did not obtain proper authorization for this practice and, therefore, violated the Act.

The OPC was contacted by a complainant who received unsolicited marketing material that was addressed to him and included his not-publicly available suite number.  After contacting Canada Post, the complainant learned that his address was included in Canada Post’s Smartmail Marketing Program (SMM Program), which is a program that combines information about individuals that Canada Post has in its possession with publicly available information and this data is sold to businesses for marketing purposes. Canada Post draws from various sources to build its database for the SMM Program, including the names and addresses present on the outside of mail that is delivered by Canada Post.  

The OPC found that Canada Post did not obtain individuals’ authorization to indirectly collect personal information from outside their mail and this violated section 5 of the Act, “which requires institutions to, wherever possible, collect personal information that may be used for an administrative purpose directly from individuals unless they authorize otherwise” [emphasis in original]. Canada Post argued against this finding, stating that (i) it provides an opt-out mechanism on its website; and (ii) the process of individuals accepting Canada Post’s general mail delivery services constitutes their authorization for Canada Post’s indirect collection practices.  However, the OPC did not agree with Canada Post, finding that most individuals would not be aware of Canada Post’s practice or reasonably expect it, and individuals’ use of traditional mail delivery services would not constitute providing permission for the SMM Program.  

Based on its findings, the OPC recommended that Canada Post cease its current personal information practices under the SMM Program.  This recommendation has not been followed by Canada Post.  Instead, Canada Post decided to remedy the situation by improving the transparency of its public communications, including clarifying its website’s language that describes its marketing services and adding related brochures to Canada Post retail outlets.

The OPC does not believe that the foregoing measures will resolve Canada Post’s contravention and has invited Canada Post to reconsider its position by exploring other options to obtain authorization from individuals, such as contacting them by mail to provide information on the SMM Program and offering a convenient opt-out mechanism for those who do not want to have their information collected for this purpose.

Summary By: Imtiaz Karamat