Interview with Canada Post

July 2003

Terry McQuay, Nymity's President, recently spoke with Richard Sharp, Corporate Privacy Coordinator of Canada Post Corporation. Richard has over 25 years of privacy experience, spending the last few years with Canada Post. Canada Post Corporation has been governed by the Privacy Act since 1983.

Nymity: Richard, based on your experience, where do you see PIPEDA having the greatest impact on Canadian private sector organizations?

Sharp : It will depend on the extent to which a company collects customer and employee information, how sensitive it is, how well it is protected and so on. It also seems reasonable to assume that companies having poor customer or employee relations will witness the greatest immediate impact in terms of access requests and complaints.

Whether or not your company receives any access requests or complaints, there are a slew of jobs to do such as policy development, personal information inventories, privacy impact assessments and so on. These typically involve corporate affairs, human resources, customer service, IT, legal and security departments, to name a few.

Nymity: The Privacy Act and PIPEDA grant individuals the right to access their information. Canada Post has experienced continued growth in access to information requests since 1983. What are the numbers and why the growth?

Sharp: When Canada Post first came under the Privacy Act, the number of access requests trickled in slowly. However, the volume of requests has doubled every five years to the current level of 1500-1600 a year. The growth can be attributed to greater awareness of privacy rights over time . About 95% of our requests are from our own employees - mostly our unionized employees and often with the assistance of union representatives. Some have even designed their own checklist request forms.

So, with perhaps a few exceptions, companies coming under PIPEDA or similar legislation in January 2004 need not fear that they will be engulfed with requests right away.

Nymity: What are the nature of these requests?

Sharp: Most employee access requests are for health and injury-related records, followed by personal files, supervisory records, grievances and human rights. Some employees are simply curious, but most want to know why a decision has been made, who said what and so on. About 5% of the time, employees gaining access will submit requests for correction and most of these are differences of opinion.

Nymity: The Privacy Act and PIPEDA have similar exceptions from access to information. What are the major exemptions Canada Post has had to use to restrict the information provided?

Sharp : The most common exemption, by far, is personal information about others. We have to be very careful to protect the privacy of others, especially in grievance and human rights files, which often contain personal information about many individuals.

We also apply solicitor-client privilege from time to time, but the most difficult exemption to apply is "injury to the conduct of an investigation." We can't simply hand over files to complainants (grievors, claimants, etc.) when we are in the middle of an investigation. Witnesses might be confronted, evidenced tampered with, alibis prepared and so on.

Nymity: What percentage of requests turn into complaints to the Privacy Commissioner's office? Also, what percentage is employee versus customer complaints?

Sharp : In our case, the odds of a complaint about the handling of an access request are about one or two in fifty. We might have been too slow, or couldn't find what they wanted or found it but refused to allow them complete access.

Nymity: Canada Post has dealt with the Privacy Commissioner's office for over 20 years. How is the organization to deal with?

Sharp : I've handled well over 1000 complaints to the Privacy Commissioner and dealt with 50 or so investigators over the years, as well as their bosses. I've also dealt with other commissions and, in my view, the Office of the Privacy Commissioner is both efficient and fair.

There will be the odd investigator who oversteps normal practice. I can't stand moving target investigations...when an investigator is reviewing one set of allegations and ends up investigating something else. There are times when a company might ask itself whether it has had a proper opportunity to respond to the allegations and findings before a finding is issued.

Nymity: Mr. Radwanski, former Privacy Commissioner of Canada, has stated in his speeches and in his resignation letter he is proud of the work he has done, and he sites Canada Post as an example. What was the nature of this work?

www.privcom.gc.ca/media/an/wn_020225_e.asp

Sharp : This would be the National Change of Address (NCOA) complaint, which was perhaps the most disappointing case I have ever handled. NCOA is a database used to update the mailing lists of large volume mailers on the condition that they already have the mover's correct name and old address. We advised movers that we were doing this right in the signature block of the change of address form. While we admittedly needed to make it easier for movers to tell us they didn't want their new address provided to mailers, some of us thought Mr. Radwanski was wrong to find that that we were in breach of the Privacy Act. Some of us thought our proposed solution was very reasonable.

Nymity: Prior to Mr. Radwanski involvement with Canada Post, had your organization received a large number of complaints about providing information to 3rd parties?

Sharp : There have been over ten million changes of address submitted to Canada Post over the past ten years and fewer than ten complaints to the Privacy Commissioner about NCOA. You do the math.

Nymity: What kind of impact did changing permissions from opt out to opt in have on Canada Post business?

Sharp : Our opt out rate went from under 1% to almost 70%, which have caused significant cost increases. As a result, we have to process mail twice (to the old address then to the new address) instead of it being mailed directly to the new address. Also, more mail needs to be returned to sender.

There isn't time at a retail counter to explain the benefits of NCOA to movers. That is why we proposed a 1-800 number instead of a check-off box. How difficult is a phone call?

I think "opt in" or positive consent is necessary in some cases, such as medical operations and tests or the disclosure of sensitive information. I don't think updating mailing lists should require positive consent as long as movers have a clear and easy to use means of opting out. I also think more people opt out for environmental reasons than to protect their privacy.

Nymity: In this case, privacy wasn't necessarily good for business. Can you provide some examples where changes in your business practices due to the legislation has benefited Canada Post?

Sharp : Our tradition of customer confidentiality at Canada Post predates the Privacy Act by more than a hundred years. Polls show that Canadians trust us more than just about any other institution. But, even in this area, I would say that the Privacy Act has reinforced that tradition.

I do think the Privacy Act has made us a kinder, gentler employer - the steps we have taken to protect employees' medical or off-duty privacy, for example, and to watch what we collect and how we use employee information, whether within the human resources department or as supervisors. It's an element of respect for the individual and employees appreciate it.

Nymity: In closing, what tips would you share with new Privacy Officers in Canada's private sector?

Sharp : Get knowledgeable and build on common interests with other key stakeholders. You can't manage what you don't know about and you can't enforce what you haven't communicated so conduct a proper inventory of your personal information holdings and develop a good privacy policy. Treat applicants and complainants with respect, regardless, and preach early resolution. And don't mess with the Office of the Privacy Commissioner.