Is your data safe with Canada Post? What we know about privacy law violations

Canada Post's gathering of personal information for a marketing program sold to businesses is “absolutely outrageous," a former privacy commissioner says.

Canada Post broke privacy laws by using personal information from the outside of delivered envelopes for a marketing program, the federal privacy watchdog has found.

The office of Privacy Commissioner Philippe Dufresne said in a report this week that the data collected by Canada Post for this program includes information about where individuals live and what kind of online shopping they do.

The data is used to create mail marketing lists rented to businesses, Dufresne’s report said.

Canada Post had not obtained individuals’ consent to indirectly collect information from envelopes for the purpose of enabling its marketing program, the federal privacy watchdog says in a report on the investigation.

Therefore, the postal operator was found to have violated section five of the Privacy Act — a finding Canada Post disputes. Dufresne’s report added Canada Post has “refused to implement our recommendation that it cease its current practice of using and disclosing personal information leveraged from its operational data for mail marketing activities without seeking authorization from individuals for the indirect collection of their personal information.”

Canada Post says it believes its program does comply with privacy laws.

Here’s what we know from the information laid out in the report.

The report says the privacy investigation began when an individual received marketing material from a local restaurant in Toronto, addressed to him, with his name and full apartment address on the envelope.