Philippe Dufresne, the country’s federal privacy watchdog, has found Canada Post is breaking the law by gleaning information from the mail – both covers and parcels – to develop the Crown corporation’s marketing program, including mailing lists it rents to businesses.
Dufresne’s office reported the information collected for the marketing program includes individuals’ addresses plus their online shopping habits, the latter of which is based on which businesses send them parcels. Dufresne found Canada Post had failed to obtain authorization from individuals to indirectly collect their personal information.
In a report highlighting his office’s investigation, the commissioner concluded Canada Post’s actions violate section five of the Privacy Act, which states government institutions “shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom it relates except where the individual authorizes otherwise or where personal information may be disclosed to the institution.”
Dufresne recommended Canada Post stop using and disclosing personal information in this way until it can seek and obtain consent from individuals; however, the postal service has disagreed with his conclusion and declined to take his suggested corrective actions.