News Release

Ottawa, March 8, 2002 - The Privacy Commissioner of Canada, George Radwanski, today sent the following letter to André Ouellet, President and Chief Executive Officer of Canada Post Corporation.

Dear Mr. Ouellet:

On January 14, 2002, I issued the finding of my investigation into a complaint regarding Canada Post's National Change of Address (NCOA) service.

I notified Canada Post that it is violating the Privacy Act by selling to business mailers, without obtaining appropriate consent, the new home addresses of Canadians who pay the Corporation to redirect their mail.

I recommended that Canada Post come into compliance with the Privacy Act, and with the privacy rights of Canadians, through a simple solution: providing check-off boxes on the face of its NCOA form so that people using this service can explicitly consent or decline to have their new address disclosed to third parties.

Canada Post, presumably on your instruction as President and CEO, has flatly refused to accept my finding or implement my recommendation.

Instead, I regret to find that Canada Post has now chosen to compound this inappropriate course of conduct by mounting a deceptive communications campaign.

In identical letters to the editor that have already been published in a number of Canadian newspapers, the Corporation - through Ms Ida Irwin, your Director of Media Relations - makes a number of statements that Canada Post knows or should know to be patently false.

I will address each of them in turn.

First, Canada Post states: "Contrary to what Mr. Radwanski claims, Canada Post does not sell mailing lists."

The fact is that Canada Post charges businesses and organizations - which can include list brokers, mass mailers and direct marketers - a "licensing fee." In exchange for this fee, the mailers are able to access the names, old addresses and new addresses of Canadians who have paid Canada Post $30 to have their mail redirected. They can then use this information to update the addresses in their existing databases.

The mailers pay a fee to Canada Post. Canada Post, in exchange, permits them to obtain certain information - the new addresses of relocating individuals. I believe most people would agree that, by any reasonable definition of the term, Canada Post is indeed thereby "selling" this information. To try to pretend otherwise is, in my view, quite simply dishonest.

Second, Canada Post states: "The five previous privacy-related complaints lodged about the service were all deemed unfounded before Mr. Radwanski became privacy commissioner."

In fact, this Office under my predecessor dealt with a total of eight complaints related to the NCOA service.

Of these, four were discontinued because the complainants did not respond to follow-up requests for information and could not be located. One was Well-Founded (Canada Post disclosed the complainant's Change of Address Notification Form to his former landlord). One was settled (the complainant's temporary move to his cottage was entered as a permanent move in the NCOA database; Canada post removed the cottage address from the database).

Only two complaints, both in 1995, were Not Well-Founded. Both involved Canada Post itself using change of address information, under a business arrangement with the Quebec Liberal Party, to mail letters from the Party advising ex-residents of Quebec of their right to vote in the Quebec referendum. The complaints were Not Well-Founded because in those instances, unlike the matter at hand, new addresses were not actually disclosed by Canada Post to any third parties.

In short, contrary to Canada Post's statement, no complaint involving Canada Post's disclosure of NCOA addresses to third parties was adjudicated as Not Well-Founded.

Canada Post is, or should be, well aware of this, since all eight complaints and their disposition are detailed in the Corporation's own "Annual Report to Parliament on the Privacy Act" documents for 1994/95, 1995/1996, 1996/97, 1997/98 and 2000/2001.

Moreover, far from finding Canada Post's sale of NCOA information without proper consent to be acceptable, my predecessor made clear to the Corporation his grave concerns.

A letter sent by this Office to Mr. Richard Sharp, Corporate Privacy Coordinator, Canada Post Corporation, on March 22, 1996 states:

"Notwithstanding the Privacy Commissioner's stated reservations concerning 'negative consent', this is the preferred option of Canada Post Corporation under the NCOA II program. It places the onus on the individual to request that Canada Post not disclose their new address to mass mailers, otherwise consent will be assumed. This does not.constitute consent to disclose personal information as referred to in the Privacy Act.

"Before consent can be said to exist the individual must be given a choice whether or not to agree to having Canada Post notify mass mailers of the new address. Consent must be clear, transparent and unequivocal."

Finally, Canada Post states in its current letters to the editor: "Mr. Radwanski is trying to create an issue where, clearly, Canadians feel none exists."

Canada Post Corporation - particularly with you, a former federal minister, as its head - must surely be aware that no Canadian law or tradition permits brazenly violating an act of Parliament provided that only a small number of people complain.

Indeed, Section 29(3) of the Privacy Act authorizes the Privacy Commissioner to initiate an investigation of any possible breach of the Act on his own initiative, even in the absence of any public complaint whatsoever.

Privacy is a fundamental human right, recognized not only in the laws of Canada but also by the United Nations. The basic premise of the Privacy Act is that our personal information belongs to us. Apart from specified exceptions, no federal institution can collect, use or disclose our personal information without our consent - and it can collect, use or disclose that information only for the specific purpose for which we gave consent.

It is therefore very wrong for Canada Post Corporation to insist on some "right" to take personal information that Canadians have provided for a specific, paid service and disclose it to third parties for financial reward - unless those Canadians go to the trouble of asking Canada Post to respect their privacy rights.

The Privacy Act mandates the Privacy Commissioner to oversee that all federal institutions respect its provisions, and to investigate all complaints that any institution is failing to do so.

I received a complaint regarding the NCOA service. I investigated, as I am required to do by law. Upon completion of the investigation, I issued a finding and made a recommendation, again as I am required to do by law. Canada Post is refusing to accept the finding or to implement the recommendation. This is unusual and problematic.

The legislative scheme is that when the Privacy Commissioner after investigation informs an institution that it is not in compliance with the Act, the institution will follow the Commissioner's recommendations to come into compliance.

The Privacy Act clearly does not contemplate that federal institutions will comply only if they agree with the Privacy Commissioner, if it is convenient, or if there are no costs associated with respecting privacy rights. Any such approach would make the law a sham.

Even though the disclosure of new addresses to mailers may not rank near the top of a hierarchy of gravity of privacy violations, this too is irrelevant. The law is the law; it must be obeyed. Rights are rights; they must be respected.

I would note further that if Canada Post believes, as it purports, that Canadians have no objection to having their new addresses sold to mailers, the Corporation should have no reluctance to implement my recommendation: allow Canadians to express their enthusiasm for this practice through a check-off consent box on the face of the NCOA form.

If, on the other hand, significant numbers of Canadians do not want their personal information disclosed in this fashion, Canada Post cannot justify continuing this practice without their express consent simply because it is profitable to do so.

Far from "trying to create an issue where.none exists," I believe that a very serious situation indeed does exist: Canada Post Corporation is breaking the law, and refusing to cease doing so.

I request that you take immediate steps to respect my findings in this matter and come into compliance with the Privacy Act as recommended.

Yours sincerely,

George Radwanski
Privacy Commissioner of Canada

cc: The Hon. John Manley

- 30 -

For more information, contact:

Anne-Marie Hayden
Media Relations
Office of the Privacy Commissioner of Canada
Tel.: (613) 995-0103
ahayden@privcom.gc.ca
www.privcom.gc.ca