What US Mailers Need to Know about Canadian Privacy

By Susan Oliver

Direct Marketing News

MARCH 2009 - While the US and Canada share many things in common, the two countries differ in their privacy regulations. So what are the privacy rules that impact US firms who want to market into Canada?

In Canada, the private sector, including the direct marketing industry, is regulated by Canada’s private sector privacy law – the PersonalInformation Protection and Electronic Documents Act (PIPEDA). First introduced in 2001, PIPEDA regulates the collection, use and disclosure of personal information in the private sector. Personal information is defined as any information that identifies an individual. This includes everything from name and address information to more sensitive information such as social insurance numbers, financial and health information. The goal of the law is to establish a minimum standard for privacy protection in Canada. The good news for direct marketers is that the law as it currently exists strikes a balance between the needs of consumers and the needs of business.

Some personal information is exempt from the law, including information that is in the public domain, such as telephone directory information, as well as the name, title, address and phone number of employees of an organization. Certain provinces in Canada – specifically Quebec, British Columbia and Alberta – have also instituted their own private sector privacy laws, all of which have been deemed “substantially similar” to PIPEDA and are therefore the privacy standard in those provinces. In addition, last year Canada’s first ever Do Not Call registry was established. Like its US counterpart, there are significant fines for those telemarketers who don’t comply.

What the Law Requires

Unlike in the US, Canada’s private sector privacy laws are broad scale, cutting across industry sectors, and are reflective of a principle-based rather than a highly prescriptive approach. Both the provincial and federal laws are based on a set of principles related to fair information practices. These principles and the associated requirements fall into three main areas: 1) Accountability and Access; 2) Notice and Consent; and 3) Data Management and Security.

Of particular importance to companies in the direct marketing business is the requirement to provide notice and collect consent. The law requires that businesses provide individuals with notice about how the information they’re collecting will be used. They must then get the individual’s consent for that purpose. Companies cannot use personal information for a new purpose without collecting new consent. Currently, the law considers different types of consent to be acceptable based on the degree of sensitivity of the information. For the collection, use and disclosure of sensitive information such as health or financial information for example, opt-in consent is required. For the collection, use and disclosure of non-sensitive information such as name and address opt-out is considered acceptable.

Those companies who want to share information with third parties must provide consumers with notice of this purpose at the time they are collecting personal information or, if that is not practical, prior to making the consumer’s name available for rental. As most commercially available lists include name and address information only, they are largely based on opt-out consent.

Impact of Privacy on List Rentals

When planning a consumer direct marketing campaign in Canada, it is essential that marketers consider privacy compliance. When renting a list, mailers need to ensure that the people on the list have had the chance to opt out. It’s important to verify that they did approve of having their names and addresses transferred for the purpose of receiving any kind of third party solicitation. To minimize the management of this compliance requirement, US firms marketing into Canada should work with a reputable list broker who has taken appropriate steps to ensure that the lists they broker are compliant with existing privacy laws. This includes getting the list owner to sign a warrant verifying their compliance as well as securing a sample of the notice that has been provided, which allows the list broker to make a decision about whether or not to recommend a list to a Client. Good brokers and their Clients know that a third party list based on sound notice and consent is ultimately a better performing list. And, a privacy compliant list protects mailers from both legal and reputational risk.

What about e-mail?

The e-mail environment presents some distinct challenges – in particular, it’s critical for legitimate marketers to use practices that differentiate them from spammers. It all starts with renting a privacy compliant list. Marketers must also be sure that their e-mail messages clearly identify both the marketer and the list owner (source of the e-mail), and that it provides the recipient with a simple and easy-to-use electronic means of opt-outing of receiving further e-mail marketing communications. In addition, marketers must follow proper e-mail conventions for elements such as subject lines, in order to avoid being caught in spam traps.

ther privacy issues related to renting lists of e-mail addresses can involve complying with anti-spam laws such as the US CAN-SPAM Act. Although e-mail in Canada is currently regulated by existing privacy laws, the Canadian government is working to establish its own anti-spam law which could come into play as early as 2009.

The Final Analysis

While privacy laws can seem like an impediment to direct marketers, our experience in Canada has taught us otherwise. Thanks to the significant focus and effort of Canadian list owners to ensure compliance with privacy laws, the list universe in Canada has remained extremely viable. By focusing on providing prominent opt-out opportunities for consumers, list owners have improved the quality of their lists ensuring that those consumers who have not opted out welcome the opportunity to receive third party offers. And ultimately, this leads to better results for mailers.

Susan Oliver brings more than 15 years of experience in the direct marketing industry. As Vice President, Marketing and Chief Privacy Officer at Cornerstone Group of Companies, Susan is responsible for marketing the company’s prospecting and data management solutions as well as managing its’ privacy policy and practice.

Before joining Cornerstone in 2005, Susan was responsible for marketing communications and privacy at ICOM Information and Communications. Prior to ICOM, Susan was Vice-President, Account Director at Wunderman. Susan is a member of the Canadian Marketing Association's Ethics & Privacy Committee.

Contact Susan at soliver@cstonecanada.com or 1-416-932-9555 ext. 424.


	Cornerstone and Privacy Trademarks and Copyrights Glossary of Terms	A Member of the Canadian Marketing Association All Rights Reserved.