It has always been clear that using a list of customers to send marketing information is a "secondary use" of personal information for which PIPEDA demands consent. It has, however, been the opinion of many that "envelope stuffers" or "invoice stuffers" that do not differentiate among customef are not really a "use" of personal information.

The Assistant Privacy Commissioner of Canada has today weighed in on the question, in PIPEDA Case Summary #308: Opting-out of marketing inserts in account statements, and has concluded that it does amount to a use of personal information. Furthermore, banks and others are required to allow customers to opt-out of this form of marketing.

The finding includes:

• The bank in this case contended that the inserts were not addressed personally to the client but rather were placed, without distinction, in the account statement addressed to the client. The Assistant Commissioner, however, noted that the customer’s personal information was still being used, and the goal of placing such inserts was nevertheless one of marketing and was secondary to the reasons for which the complainant initially gave his personal information, namely to receive a credit card.
• The bank informed the complainant through its agreement and disclosure statements that clients might receive marketing information with their account statements. While the bank believed it reasonable for customers to opt-out of secondary telephone or direct marketing, and offers customers the option to refuse such marketing, it did not believe it reasonable for customers to opt-out of statement inserts, many of which concern products or services that have nothing to do with the service for which the customer provided his or her personal information. As the Assistant Commissioner noted, marketing is marketing, whether it arrives in a bank statement or in the form of a telephone call. The bottom line is that, under the Personal Information Protection and Electronic Documents Act, individuals have the right to opt-out of secondary marketing.
• The Assistant Commissioner therefore determined that by not providing a means of withdrawing consent to secondary marketing, the bank was requiring the complainant to consent to a use of his personal information beyond that required to fulfil the purpose of servicing his credit card account, in contravention of Principles 4.3.3 and 4.3.8 of Schedule 1.

Labels: information breaches, privacy