Subscriber objects to magazine's rental of his name and address to marketers

PIPEDA Case Summary #2003-167

[Principles 4.2.3, 4.3, 4.3.2, 4.3.5, and 4.5, Schedule 1]

Complaint

A magazine subscriber complained that the organization had been selling or renting his name and address to third parties without his consent.

Summary of Investigation

In a letter to the magazine, the complainant objected to its practice of selling his name and address to other companies, requested that his name be removed from any mailing list used for that purpose, and asked why the magazine had not thought it necessary to notify him of such practice on his subscription card. The magazine wrote back to assure him that it had removed his name from its list rental database, that it had instructed its list-renting companies to do likewise, and that it could have his name excluded from direct marketing by all member organizations of the Canadian Marketing Association if he so wished. The magazine pointed out that the masthead of each of its issues contained notification of the practice in question and of the opt-out procedure.

The magazine's masthead did contain a notification to the effect that subscribers' names were sometimes made available to other companies and that individuals could have themselves excluded from mailings by written request. However, this notification appeared in very small print and was buried in a dense paragraph of miscellany at the bottom of a column. Also, it did not identify the companies or types of companies to which subscribers' names were made available, did not explicitly state that subscribers' addresses were made available as well, and mentioned only one method of opting-out (i.e., request by mail). No such notification appeared on the magazine's subscription card.

The magazine contended that it was following not only the practice of most magazines, but also the guidelines established by the Canadian Marketing Association. The organization nevertheless acknowledged that the Canadian Marketing Association privacy code lacked clarity on the opting-out issue, further agreed that the matter was a problem requiring attention under the Act, and indicated that it would welcome recommendations from the Commissioner. However, it also expressed concern about being put at competitive disadvantage if it were to undertake a level of disclosure different from that of the rest of the industry. It informed the Office of its intention to take the Commissioner's recommendations to the Canadian Marketing Association for discussion.

Commissioner's Findings

Issued April 11, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies not only to any federal work, undertaking, or business, but also to disclosures of personal information made by any organization across borders for consideration. The Commissioner had jurisdiction in this case because it was determined that the magazine sometimes discloses subscriber information for consideration to companies in other provinces and the United States.

Application: Principle 4.2.3: The identified purposes should be specified to the individual at or before the time of collection. Principle 4.3: The knowledge and consent of the individual are required for the collection, use, and disclosure of personal information, except where inappropriate. Principle 4.3.2: Pursuant to the "knowledge" requirement, organizations must make a reasonable effort to ensure that the individual is advised of the purpose for which the information will be used; for consent to be meaningful, purposes must be so stated that the individual can reasonably understand how the information will be used or disclosed. Principle 4.3.5: In obtaining consent, the reasonable expectations of the individual are also relevant. Principle 4.5: Personal information must not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.

The Commissioner found especially interesting the question the complainant himself had raised: Why had the organization not thought it necessary to inform him on his subscription card that it was intending to disclose the information he was providing on the card? The Commissioner observed that, in posing this question, the complainant had in effect been expressing his expectation that the magazine should have brought its secondary purpose to his attention up front, on the occasion when he was making the decision to subscribe and thereby entrust his personal information to the organization. The Commissioner's task was to determine whether such expectation on the complainant's part had been reasonable.

He noted that he had previously established the position that an individual whose consent to third-party disclosures is being merely assumed has all the more reason to expect the organization to be forthright and diligent about explaining its intentions and affording an opportunity to opt out. The Commissioner has tended accordingly to give full weight to the "knowledge" principles, notably Principle 4.2.3 and 4.3.2, as well as to the individual's reasonable expectations as deemed relevant under Principle 4.3.5.

Since it was taking the liberty of assuming the complainant's consent to the secondary purpose, the organization should have also taken pains to bring that purpose clearly and directly to the complainant's attention at the time he was considering his subscription. The complainant had had good reason to expect

• to be informed, on the spot, of any assumption of his consent;
• to have any secondary purposes brought to his attention and explained on the spot, so that he would know what items of his personal information were at risk of being disclosed and the nature of the third parties to which disclosure was intended; and
• in the event that he did not consent, to be provided, on the spot, with a convenient and immediate opportunity to opt out before any unwanted disclosure occurred.

Conversely, the complainant had had no good reason to expect to have the onus of actively seeking out an organization's secondary purposes in places where he would not otherwise have even thought to look.

In sum, the Commissioner determined that the magazine, having relied wholly upon an undistinguished, sketchy, and small-printed purpose statement and opt-out opportunity not reasonably available to the complainant at the time of subscription, could in no way be deemed to have duly specified to the complainant its secondary purpose of disclosing his personal information to third parties or to have otherwise made a reasonable effort of advising him of that purpose in an understandable manner. The Commissioner found therefore that the organization was in contravention of Principles 4.2.3 and 4.3.2.

He determined furthermore that, in neglecting to duly attend to the complainant's knowledge in accordance with his reasonable expectations, the magazine could in no meaningful sense be deemed to have obtained his consent. The Commissioner found therefore that the organization was also in contravention of Principles 4.3 and 4.5.

He concluded that the complaint was well-founded.

Further Considerations

Before making recommendations, the Commissioner clarified that his conclusions in a given case were never meant to be subject to industry approval. The Act is the new industry standard for the management of personal information, and he expects compliance from an industry as a whole no less than from particular organizations within it. He fully approved of the magazine's intention to take his recommendations to the Canadian Marketing Association for discussion, but he wanted it to be understood that they were meant not for negotiation, but rather for adoption.

The Commissioner recommended that the magazine (1) include a purpose statement and a checkoff box on its subscription form; (2) display the statement prominently in regular type size and include in it a description of the items to be disclosed (i.e., name and address) and the organizations to which the disclosures are to be made (provided that organizations are identified at least by type and the items of information to be disclosed remain limited to name and address, the magazine may continue to use the "opt-out" form of consent); (3) for ongoing use, provide and prominently advertise a mechanism whereby subscribers may conveniently, inexpensively, and promptly withdraw consent, such mechanism to include a toll-free telephone number; and (4) further to immediate implementation, follow through with its intention to present the Commissioner's recommendations to the Canadian Marketing Association and, in doing so, convey his expectation that all Canadian Marketing Association members will quickly adopt them by way of setting a new industry standard of compliance.