Canada Post changes stance on using negative consent to sell addresses to mass mailers

My Office received a complaint that Canada Post, a Crown corporation, was improperly disclosing personal information collected for its National Change of Address (NCOA) service. The complainant stated that Canada Post was selling subscribers' new addresses to mass mailers and direct-marketing companies unless subscribers to the service contacted the corporation in writing to specifically request that their information not be used for that purpose. This practice is what is known as "negative consent," and it is something Canadians have been known to get very upset about.

For this service, individuals pay a fee to Canada Post to have their mail forwarded until they have had an opportunity to notify others of their change of address.
To subscribe, they sign a Change of Address Notification (COAN) form containing the following acknowledgement:

... I understand the information I provide will be used to deliver mail to my new address. I also agree Canada Post may supply this new address to mailers, provided they request it and already have my correct name(s) and old address.

By signing this statement, individuals asked Canada Post to perform the specific service they paid for - redirecting their mail to their new address. But they were also agreeing to something that they didn't specifically request - allowing Canada Post to sell their new address to mass mailers and direct-marketing companies - unless, as indicated on the back of the form, they wrote in and told the corporation not to do so within seven days.

Many individuals may have read this section, without realizing that "supply" meant sell and that "mailers" meant any mailers - primarily, companies that send junk mail.

I informed Canada Post of my concern that subscribers were not aware they were consenting to the provision of their information to mass mailers when they signed the COAN form. Canada Post argued that subscribers provided consent when they signed the form and that they could notify the corporation if they did not want their new address provided to all mailers. I pointed out that, to stop Canada Post from selling their information to mass mailers, subscribers would have to read the fine print on the front of the form that referred them to further details on the reverse side. The reverse side stated the following: "At no additional cost, Canada Post will help you advise businesses and other organizations of your new permanent address."

I disagreed with Canada Post's stance that it had obtained consent. Not only is the notion of "negative consent" insensitive to the privacy rights of Canadians, but Canada Post didn't really obtain proper consent at all. Under the Privacy Act, an organization does not have your consent if it has not told you what you are consenting to.

Informed consent was the real issue. Section 5(2) of the Act requires a Government institution to inform you of its purposes when it collects personal information from you. Was Canada Post informing those who subscribed to the NCOA service of its purposes, plainly and fully? Would reasonable persons, on reading the COAN form, conclude that they were giving consent for the sale of their personal information to mass mailers and direct marketers— I was quite sure they would not. In matters involving consent, the reasonable expectations of the individual are also relevant.

Canada Post initially agreed to adopt some of my recommendations to make the NCOA service more transparent and sensitive to privacy rights. It agreed to replace the word "acknowledgment" with "authorization" on the front of the COAN form and to add the phrase "including direct mailers" in the statement. But Canada Post was reluctant to accept my main recommendation: to give subscribers to the service a positive choice in the matter by adding an opt-in box on the front of the form. It believed that such an addition risked undermining the NCOA service and would lead to frustration and inconvenience for its customers.

I convinced Canada Post otherwise. I argued that Canada Post would benefit from such an addition, since its customers would appreciate that the corporation was doing everything in its power to maintain their privacy, and that customers would also benefit. Customers who want to receive mail from mass mailers can clearly indicate their choice, while those who don't want the junk mail will also have a choice in the matter. But the customer would have the choice, not Canada Post.

Canada Post finally agreed to add an opt-in box on its COAN form.

The Privacy Commissioner of Canada released this finding under the Privacy Act.