The Office of the Privacy Commissioner of Canada (OPC) announced, on May 12, 2023, that it had concluded an investigation against the Canada Post Corporation (CPC) for the collection and use of personal information for marketing purposes, in violation of the Privacy Act 1985, following a complaint from an individual. 

Background to the decision

In particular, the OPC noted that the individual complained about the CPC's Smartmail Marketing (SMM) Program practice that made use of the personal information gathered from the outside of delivered envelopes and parcels to create mail marketing lists that it rented to the private sector. The OPC stated that the complainant received unsolicited marketing mail addressed to them, including their not-publicly available suite number which the CPC confirmed was due to their name being included in the SMM Program list CPC provided to a third party for a fee.

Findings of the OPC

During the course of the investigation, the OPC found that the CPC had not obtained individuals' authorization to indirectly collect personal information from the outside of envelopes that it delivered for the purpose of enabling its marketing program, in violation of Section 5 of the Privacy Act 1985.

The OPC further stated that it did not accept CPC's arguments that it was not using the personal information for an administrative purpose and that the mere availability of an opt-out mechanism, and/or the fact that individuals accept mail delivery by CPC generally, constitutes authorization by individuals for CPC to indirectly collect and use personal information from outside of envelopes for marketing purposes.

Outcomes

In light of the above, the OPC found the CPC in violation of Section 5 of the Privacy Act 1985 and recommended the CPC to cease its current practice of using and disclosing personal information for mail marketing activities without seeking authorization from individuals for the indirect collection of their personal information. The OPC also recommended that the CPC take steps to bring its activities into compliance with the Privacy Act 1985 and urged it to re-consider remedial options such as an acceptable mail-out process.

You can read the investigation here.