Privacy Commissioner's finding on Canada Post's National Change of Address service
Ottawa, February 25, 2002 - Due to widespread public and media interest, the Privacy Commissioner of Canada, George Radwanski, today released the following finding under the Privacy Act. The finding is a letter to Canada Post.
This is further to my letter of July 12, 2001 concerning a Privacy Act complaint filed by an individual about Canada Post's National Change of Address (NCOA) service. In accordance with section 35, I am now writing to provide you with my findings.
First, I would like to reiterate the facts of this case as outlined in my previous letter to you.
Canada Posts offers the NCOA service at a fee to individuals who want to receive their mail until such time as they have had an opportunity to notify parties of their change of address. Individuals who subscribe to the service are informed that they are agreeing to have their mail redirected. They are asked to sign the following authorization:
"I understand the information I provide will be used to deliver mail to my new address. I also agree that Canada Post may supply this new address to mailers provided they request it and already have my correct name and address."
Customers may contact Canada Post and state that they do not want their new address provided to certain organizations or businesses. However, to know this, they must read the fine print on the back of the NCOA form, which states that:
"At no additional cost, Canada Post will help you advise businesses and other organizations of your new permanent address. These mailers must request it and already have your name(s) and old address."
Should customers not want this added service, they must write a letter to Canada Post within seven days. By forcing individuals to take the initiative and write to Canada Post indicating that they do not want their new address disclosed to certain organizations or businesses, the Corporation is using "opt-outs" as a means of obtaining their consent, in other words "negative consent".
Other than the back of the NCOA form, none of Canada Post's literature, including its website, informs customers that they may opt-out from having their information provided to "mailers". Canada Post's brochure entitled "Smart Move - a guide to making an individual's move easier", explains the NCOA service to individuals and indicates that its purpose is "to ensure that you do not miss important mail sent to your former address." No mention is made in this publication or on Canada Post's website that an individual's new address will be provided to "mailers".
We discovered during the course of our investigation that "mailers" could be any organization-for example, list brokers, mass mailers or direct marketers. While Canada Post claims that they will advise these organizations of an individual's new address at no cost to the individual, the information is provided to them by Canada Post for a fee. What this means, in fact, is that the individual's personal information is sold by Canada Post to organizations that will use the information for purposes other than the purpose for which the information was originally collected.
Therefore, while customers are aware that by subscribing to the NCOA service they are agreeing to have their mail redirected, they are not aware that their personal information is being sold by Canada Post to any organization, which may include list brokers, mass mailers or direct marketers.
When we first approached your officials on the subject of the NCOA service, we raised three concerns. My first concern was about the language used on the form to obtain an individual's consent. Second, individuals are not clearly informed that their information is sold to mass mailers or direct marketers. Third, personal information is sold without informing clients of this practice and without obtaining their consent.
Regarding these concerns, your officials argued that there is a safeguard in place. It only provides the new address to mass mailers or direct marketers who already have a customer's name and old address unless the customer contacts Canada Post and states otherwise. We pointed out to your officials that companies sell, rent and trade mailing lists to each other. Many of these companies may have created their lists without obtaining the prior consent of the concerned individuals. Therefore, it is evident that this safeguard claimed by Canada Post does not adequately address my concern regarding consent. Your officials stated that obtaining consent in that regard is not their responsibility.
Nonetheless, your officials agreed to amend the NCOA form to change the word "acknowledgement" to "authorization" and to add the phase "including direct mailers" to the purpose statement.
I considered Canada Post's proposal and concluded that if implemented, it would not be sufficient to deal with the lack of transparency of the authorization statement and with the negative consent problem. I came to this view because individuals are not aware that this statement in fact refers to any organization, which may include list brokers, mass mailers or direct marketers. Individuals should have the right to consent knowingly to the disclosure of their information. This is not clear when they subscribe to Canada Post's NCOA service.
Having come to this conclusion, I made my views known formally to you. I recommended that Canada Post clearly indicate in its brochure and literature, including the NCOA form, that the selling of an individual's new address to any organization, which may include list brokers, mass mailers or direct marketers, is one of the features of the NCOA service. I further recommended that Canada Post add a check off box feature on the face of the NCOA form that would allow individuals to consent to the sale of their personal information. You agreed with my first recommendation to make the process more transparent to users, but you categorically refused to implement the more important of my two recommendations, which was to obtain informed consent from NCOA users by adding a check off box feature on the face of the NCOA form.
Because of the seriousness of this issue, I also brought my concerns to the attention of the Minister Responsible for Canada Post, the Honourable A. Gagliano, P.C., M.P. Unfortunately, the Minister also refused to implement my second recommendation.
I must now provide you with my findings with respect to (the) complaint. Section 5(2) of the Privacy Act requires an organization to inform an individual from whom it collects personal information about the purpose for the collection. It is my view, moreover, that the force of this provision depends upon the plain and full identification of purpose; in cases of disclosure to a third party for commercial purposes, for example, such identification should extend to indicating the nature of the third party's business. Section 8 of the Act requires that consent be obtained from the individual with regard to the disclosure of personal information. Section 8(2) prescribes exceptions whereby an organization would be allowed to disclose information without obtaining consent.
I have determined, first of all, that, in failing to specify to NCOA applicants its intention of disclosing new addresses to mass mailers and direct marketers for a commercial purpose, Canada Post does not meet the requirement for plain and full identification of purpose. I have also determined that the individual's consent for such disclosure is required under section 8, given that none of the exceptions prescribed in section 8(2) apply.
Does Canada Post have individuals' consent for the disclosure of their new addresses to mass mailers and direct marketers? You contend that it does. On my part, I hold that in matters of consent the reasonable expectations of the individual are relevant. I am satisfied that a reasonable person, on reading and signing the NCOA application form, would not conclude that he or she was giving consent for the disclosure of personal information to mass mailers and direct marketers. I find therefore that Canada Post is in contravention of sections 5(2) and (8) of the Privacy Act.
Accordingly, I have concluded that (the) complaint is well-founded.
Therefore, until such time as Canada Post changes its process with regard to the NCOA service, I am of the view that it is violating the privacy rights of all subscribers to this service.
Should you have any questions, please do not hesitate to communicate with my office.
Yours sincerely,
George Radwanski
Privacy Commissioner of Canada
- Date modified: