By Nathan Hoo and Johann Kwan with research by Stéphane MacLean
Over sixteen years ago, Canada Post was criticized by the Privacy Commissioner of Canada for failing to adhere to its obligations under the Privacy Act. At the time, the Privacy Commissioner found that Canada Post violated the Privacy Act by failing to alert customers applying to their mail-forwarding service, the National Change of Address (NCOA) service, that their new addresses would be disclosed to mass mailers and direct marketers.
Canada Post made changes to its implementation of the NCOA service following the Privacy Commissioners findings. In the post below, we examine how Canada Post has changed the NCOA service and how that information is being used. Then we will examine Canada Post’s wider marketing offerings, and see how the NCOA service plays into these offerings.
The original complaint
The Privacy Commissioner determined in 2002 that the complaint filed by an individual against Canada Post was well founded. Canada Post had not met its obligation under Section 5(2) of the Privacy Act to inform individual NCOA applicants, from whom it was collecting personal information, of the purpose for its collection. According to the Commissioner, Canada Post failed to specify to NCOA applicants of its “intention of disclosing new addresses to mass mailers and direct marketers for a commercial purpose“ and, therefore, did not meet the Act’s “plain and full identification of purpose” requirement.
Furthermore, the Commissioner found that proper consent was not obtained for the disclosure of the individuals’ new addresses to mass mailers and direct marketers because “a reasonable person, on reading and signing the NCOA application form, would not conclude that he or she was giving consent for the disclosure of personal information to mass mailers and direct marketers.”
Simply put, the commissioner found that subscribers to Canada Post’s NCOA service were unaware that they were consenting to a provision that allowed Canada Post to sell their new address to mass mailers and direct-marketing companies.
Canada post makes changes to their mail-forwarding form pursuant to the Privacy Commissioner complaint
In 2003, Canada Post agreed to make changes to the NCOA service to comply with the Privacy Act. It attempted to do this by changing the form used to sign up for the service, known as the Change of Address Notification (COAN) form.
The Privacy Commissioner noted that Canada Post adopted some of the Commissioner’s recommendations. They made changes to the front of the COAN form and eventually agreed to offer an opt-in box to have their personal information sent to mass mailers, rather than a negative consent obligation.
The current state of Canada Post’s mail-forwarding form
If these changes were adopted in 2003, they do not appear to have lasted the test of time. Canada Post’s current mail forwarding form does not feature an opt-in box. Rather, it features an opt-out box to opt out of their NCOA Mover Data service.
The opt-out box on the current mail forwarding form.
Furthermore, the wording of the text accompanying the opt-out box emphasizes that by checking the box, the customer is losing out on a service, which could result in their not receiving important mail. The individual is invited to check a box if they “do not want this feature” (emphasis ours). It is not obvious from the text that it is also a way to prevent Canada Post from sharing personal information. The text reads as follows:
Mover Data Service (Applicable if you are moving from a residential address)
Canada Post can provide your new address to organizations you deal with. By not participating in this service, important correspondence such as financial statements and recall notices may be delivered to your old address after your Mail Forwarding service expires. To be eligible, organizations must have your correct names and old address on file and agree to use your new address for the sole purpose of updating their customer records.
As we can see, the Mover Data Service is sold as a way of not losing “important correspondence such as financial statements or recall notices”. It does not highlight that the Mover Data Service is used to allow marketers to reach consumers at their new address.
In 2011, Canada Post told CBC News that “more than 80 per cent of customers do not check the box — which means they give their consent [to share their personal information].” This was told to CBC in the course of an investigation into the sale of Mover Data information by Canada Post of an elderly mail scam victim to the marketers who had previously scammed him. The daughter of the elderly scam victim—who has power of attorney—clearly stated that she either did not notice the box, and even if she did, thought it was to update Canada Post’s own files.
How does Canada Post use this information?
Although Canada Post’s Privacy Policy maintains that it does not sell personal information to anyone, it offers business marketing products that clearly leverage its use of customers’ personal information.
NCOA Mover Data service
The personal information obtained through the NCOA form feeds into the National Change of Address (NCOA) Mover Data service. Canada Post sells NCOA Mover Data to business customers so they can update their own mailing lists with correct addresses. It also licenses NCOA data to businesses that cleanse mailing lists for third-parties (referred to as ‘service providers’).
There are some limitations. NCOA data can only be used to update a business’s own database if the addresses belong to customers with whom the business has a “business relationship”. It is not clear when a business has a “business relationship” with a customer.
Otherwise, the business can only use the NCOA data to correct a mailing list. Service providers pay Canada Post to lease the updated address data and then develop their own address-updating services which they can sell to third parties. These service providers are subject to similar conditions as the businesses who possess mail lists, and thus are also prohibited from using the data for “any other purposes other than correcting mailing lists or updating databases where a business relationship exists“.
Direct Mail Campaign
All of this information also feeds into Canada Post’s broader direct mail campaign services. Canada Post offers businesses the ability to send advertising mail to broad or narrow sets of customer targets.
Canada Post offers direct mailing services to: (1) send mail to “every home, apartment and business in specific neighbourhoods or regions” with their Neighbourhood Mail service; (2) use “postal code data to find new customers that share the same qualities as your best customers” with their Postal Code Targeting service; and (3) send directly personalized mail to individual customers to “connect one-on-one with customers; support loyalty, retention and cross-sell initiatives” through their Personalized Mail service.
In addition to these services, Canada Post’s mail forwarding data is further leveraged in direct mailers to target “movers” as a unique demographic with their “smartmoves” program. Movers can be targeted with ads in magazine, through outserts packaged with that magazine, through the Canadapost.ca site, and through direct mail. Canada Post sells the smartmoves program as a service that “leverages and extends Canada Post’s familiar address change services”.
Canada Post notes that movers spend money, and “are in hyper-spend mode with an average of $7,900 being spent over the course of the move lifecycle.” The marketing materials for the smartmoves program suggest that marketers “get exclusive access to our Mail Forwarding database. Reach more than 800,000 households from coast to coast.”
Prospect Lists
Canada Post also rents ‘prospect lists’ (lists of mail addresses of potential customers) to businesses. Canada Post offers services to better target a specific type of customer based on any number of factors, including their demographic profile, location, online purchasing habits, recent movers, etc. As Canada Post advertises, it will help businesses “[t]arget anyone in Canada from high-spending new movers to tech-savvy millennials.”
Fortunately, Canada Post does not actually give businesses access to the ‘rented’ mailing list or the mail forwarding database. Instead, the list is given to a third-party mail service provider. Under this system, it can leverage the personal information it owns without actually disclosing it to another party. For example, a business may rent a mailing list from Canada Post with the following demographic specifications: males, 20 – 30 years old, residing in National Capital Region, who purchase online during Christmas holidays. Canada Post will then generate a mailing list with these specifications, but will only make the list of addresses available to the third-party mail service provider. The business then makes arrangements with the mail service provider to send their advertisements to those specific addresses. Consequently, the business can reach its target customers without ever acquiring the addresses or any personal information associated with them.
Conclusion
So does Canada Post sell personal information to third parties? Not exactly. It collects personal information from private customers who agree to use their products and services subject to permissive terms and conditions. It also shares information with third parties provided that the customer has previously consented to having their information collected by those same third parties. While it does not technically sell personal information to anyone, Canada Post offers business-marketing products that leverage its personal information database. Although it does not share these mailing lists or personal information directly with the businesses using it, the practice does appear to open the possibility that businesses will learn the personal characteristics of mail targets who reply to a mail campaign directed at a specific customer profile.