Canada Post Sharing Personal Information with Credit Bureau

Protecting against identity theft has complicated what was once a relatively simple matter - changing your mailing address with the post office - especially when Canadians want the convenience of doing this online.

The online process takes seven steps, and a man complained that the final stage consisted of Canada Post checking his credit rating,

Our investigation established that Canada Post has a legitimate need to confirm the identity of individuals requesting a change of address. Misdirection of personal mail is a common tactic in identity theft.

To verify identity in online requests, Canada Post has contracted with Equifax, best known as a credit-rating agency.

Personal information provided online to Canada Post by a requestor is sent electronically to Equifax.

The online requestor is also transferred seamlessly to Equifax's identity verification website and asked questions about outstanding loans and other financial dealings listed with the credit-rating agency.

If the individual correctly answers these "out-of-wallet" questions, Equifax advises Canada Post that their identity has been successfully verified. Canada Post then processes the payment for the change-of-address transaction and the individual's address change will be activated.

Equifax assured us that any information provided by the individual during this identity verification process will be kept entirely separate from the information it collects and maintains in the individual's credit file for credit reporting purposes.

As a result of our investigation, we were satisfied that Canada Post has the statutory authority to collect the personal information used in this online process. Further, we were satisfied that Canada Post does not conduct a credit verification of individuals wishing to change their address online. Consequently, there has been no violation of the Privacy Act in that regard. We found the complaint was not well founded.

Nevertheless, our Office was concerned that individuals were not adequately informed that their personal information was being shared with Equifax. Therefore, we recommended that Canada Post clearly state on its website that an individual's personal information will be disclosed to Equifax and also that it list the personal information that will or may be disclosed. As well, we recommended that Canada Post clarify its identification requirements for online applications. Canada Post implemented our recommendations.