Canada Post Corporation (CPC), the government-owned organization that has provided national mail service to the country since 1981, has been scanning address data from the outside of envelopes it delivers and selling it to third-party mail marketing lists. A complaint filed with the Office of the Privacy Commissioner of Canada (OPCC) alleges that this violates a Privacy Act requirement to obtain authorization about individuals before collecting information in this way.
The address data is collected as part of the CPC’s “Smartmail Marketing” program, a direct marketing revenue stream it has run since 2015 and that has offered precise customer targeting at the zip code level since at least 2017. The complaint was filed when an anonymous party began receiving unsolicited marketing mails to an unlisted mailing address, learning that the marketers had obtained the address by purchasing it from the Smartmail program.
Mail marketing program sells unlisted addresses, targets customer interests
Canada switched from a more traditional post office structure to the CPC “Crown corporation” model in 1981. The CPC remains state-owned and directly accountable to Parliament, but aside from certain government appropriations to offset government mail costs it is expected to develop its own revenue and essentially operate as a for-profit company (albeit one with an effective monopoly on numerous segments of Canadian mail service).
Mail marketing has long been part of that revenue strategy, and something that the CPC claims is essential to keep its business running. Under the current program, address data from the outside of envelopes and packages that the CPC handles is paired with information about who parcels come from (such as specific retailers) and the zip code location of the recipient. Marketers can then obtain list collections of this information and use them for a form of targeted advertising; not as detailed as what happens on phones and computers, but still containing personal and potentially sensitive information.
Section 5 of the Privacy Act is where this mail marketing scheme may run into trouble. The complaint notes that any government institution must obtain authorization from individuals to collect information from them for an “administrative purpose.” The complaint alleges that collecting address data and selling it for marketing is in fact an administrative purpose. Clear permission must be given for authorization to be established under these rules, and the subject must be sufficiently aware of or reasonably expecting the practice to occur.
In response to the complaint, OPCC has found that CPC’s collection of address data does indeed violate Section 5 of the Privacy Act. The OPCC found that this program qualifies as an administrative purpose under the regulation’s terms, and that the provision of an opt-out link was not a sufficient substitute for establishing informed consent.
Address data collection and use under review
CPC initially disagreed with OPCC’s assessment, and refused to follow the agency’s recommendation (it was not able to issue a formal order at that point) that it implement a valid authorization scheme for its mail marketing data collection. The agency recently reversed course after a further review of the Smartmail program by the office of Privacy Commissioner Philippe Dufresne, however, and is now saying that it will review how it collects and uses address data for profit.
CPC has not yet settled on a course of action, saying only that it was “looking at ways to better inform Canadians on how their mailing data is utilized, while outlining their options.” The agency already made some more minor moves in response to the initial report from OPCC: it has added details to its website about how personal information is used for mail marketing, improved the visibility of the opt-out link, and created a paper brochure outlining these measures that is now distributed at its retail locations.
The company’s 2022 financial statement indicates that mail marketing is more critical to it than ever. CPC reported a pre-tax loss of $548 million, $58 million more than was lost in 2021. With volume of letters falling for some years now, the company had turned to retail parcel delivery as a primary revenue source. But with that too now down due to economic uncertainty, direct marketing is one of the only lines it presently has that is recovering and heading in a positive direction (increasing by $32 million in revenue on the year).
A prior Canada Post controversy that played out over 2020 and 2021 may have involved address data, though the company’s direct liability and involvement was also limited. A conservative paper called The Epoch Times began sending unsolicited copies to specific targeted neighborhoods during the Covid-19 pandemic, causing some complaints about editorials asserting that the virus was engineered in China. Two letter carriers later resigned in 2021 when asked to carry mass-mailed pro-Trump editions of the paper to houses.