Canada Post helped scammers get victim's new address

The daughter of an elderly mail scam victim is complaining to the federal privacy commissioner about Canada Post — after it sold her dad's new address to mail sorting companies — which then provided it to the same marketers who had scammed him.

Elderly man's family diverted his mail; Canada Post sold that data

Lorraine Funk thought Canada Post would help her father end a junk mail scam, but instead the Crown corporation helped the scammers keep track of their victim 2:35

The daughter of an elderly mail scam victim is complaining to the federal privacy commissioner about Canada Post — after it sold her dad's new address to mail sorting companies — which then provided it to the same marketers who had scammed him.

"They are a Crown corporation and they should not under any circumstances be selling personal information," said Lorraine Funk of Swift Current, Sask.

Funk said her 84-year-old father, Peter Wieler, had fallen victim in recent years to mail-in contests and other schemes. She said he was on several customer mailing lists, and would get piles of letters in the mail encouraging him to send money and win a prize.

"He had gotten involved in a lot of the junk mail where you are sending away money and getting back little crappy prizes, and he thought he was going to win a lot of money," said Funk.

She estimates her father — a retired farmer on a fixed income — was taken for about $30,000.

"And at one point, we had the RCMP involved. He's got all kinds of junkie trinkets to show for it but he doesn't have any money to show for it."

Mail forwarded

Funk and her brother — who has power of attorney — decided to divert the mail away from their dad, hoping to break him of his obsession. They went to their local post office and filled out a "Change of Address Notification" form — to get their dad's mail forwarded to Funk's post office box.

"We just thought 'OK it will come to my box number and I will look after it and dad won't have to see it — and it's taken care of'," said Funk.

Lorraine Funk changed her dad's address, hoping to stop scammer's letters from reaching 84-year-old Peter Wieler. ((CBC))
They paid the $72.50 fee to divert Wieler's mail for a year. Funk was moving in with her parents to care for them, and she figured that by the time the year was up her dad would be broken of the habit. She also thought she would then be able to collect any further mail from his home mailbox herself.

Funk said she was shocked when mail from the same marketers her dad had sent money to starting showing up, addressed to Peter Wieler, but bearing her post office box number.

"I look at it and it's like whoa - just a minute. This has got my box number on it addressed to him," said Funk.

"I was quite upset. There is absolutely no way this information could have gotten out from my dad because he doesn't even know what my box number is."

Funk asked her local post office how that could have happened and she said no one there knew. She said she called the Canada Post office in Regina, and was told her information had been sold as part of the routine in its mail forwarding system.

"That the government would do something like that — I couldn't believe it. That they would be allowed to make money off your private information," said Funk.

Data sold to 37 companies

Canada Post declined an interview about this, but confirmed to CBC News that it charges 37 companies — nine of them in the United States — $10,000 a year each, to access its National Change of Address (NCOA) database, which contains thousands of new addresses. The companies typically sort mail, stuff envelopes and update address lists for hundreds of mail marketers.

"The data gathered from the Change of Address service is used to create the National Change of Address data product licensed to businesses for the purposes of cleaning mail files and updating the records of existing customers," Canada Post spokesperson John Caines wrote in an email.

Funk said she was shocked when mail started showing up under her dad's name, but addressed directly to her P.O. box. ((CBC))
Canada Post stressed only marketers that have had some kind of recent customer interaction with the addressee will actually receive their new information. It said it tests the system regularly — to make sure the data isn't being sold indiscriminately  — by putting in "fake" addresses and checking to make sure nothing gets delivered to them.

"This service reduces the risk of important and sensitive mail being sent to the customer's old address after they have moved," said Caines.

Canada Post confirmed mail from mass marketers can also get to the new address — if those mailers pay a NCOA licensed mail service company to update or "clean" their address list — and mail their flyers out directly. Those marketers do not get direct access to the actual database information, though, Canada Post said.

"It's an eye opener to realize that you need to be more selective about the information that you give out," said Funk.

One million new addresses

Almost one million Canadians use Canada's Post's change of address system each year. Because of past privacy concerns, the corporation added a box to the form — where customers can opt to not have their new address shared.

Submit your story ideas:

  • Go Public is an investigative news segment on CBC TV, radio and the web.
  • We tell your stories and hold the powers that be accountable.
  • We want to hear from people across the country with stories they want to make public.

Submit your story ideas to Kathy Tomlinson at Go Public

"With your consent, Canada Post will share your change of address with Canada Post authorized organizations for the exclusive purpose of updating their existing customer files," the form reads. It indicates customers should check the box if they "do not wish to receive this service."

Canada Post said more than 80 per cent of customers do not check the box — which means they give their consent.

Funk said she didn't notice the box — and even if she did, she wouldn't have known what it really meant.

"[It says] authorized organizations…and existing customer files — so it sounds like it's just for [Canada Post's] files. Like if you tick this box you just might miss out on getting some important service," she said.

Canada Post charges 37 companies $10,000 per year to access its Change of Address database. ((CBC))
"Of course, they don’t ask you whether you want to…eliminate the junk mail or get rid of this stuff, and [they] don’t ask you whether you want to tick that box or not. It’s just kind of like, here you go, pay your fees, off you go and you think it’s taken care of."

CBC News went into the main downtown post office in Vancouver, and asked at the counter: "Where does all this information go – like the new address and everything?" 

A Canada Post employee responded, "It’s internal. Computerized. Automated. And it goes to a department where they create new labels for your mail." 

'We do not share information': employee

We asked, "Does this information go to anybody else?" He answered "No." When asked, "You guys don’t sell it to anyone else?" he replied, "Can’t. We’re not allowed. It’s Canada Post. We do not share information."

The Office of the Privacy Commissioner of Canada indicated it is investigating Funk's complaint.

Jennifer Stoddart's office told CBC News she is not doing interviews during the election, but several years ago the commissioner determined Canada Post's practice is OK, in general, provided people know what they are consenting to.

"After careful consideration and examination of the issue, we determined that the use of the opt-out was reasonable," said a spokesperson.

Allan MacDonald is a Vancouver lawyer with experience in privacy law for both the public and private sector. He said the form does not make it clear enough what customers are really consenting to.

"Number one, it's highly doubtful that this form secures the proper consent for Canada Post to be disclosing this information," said MacDonald.

MacDonald pointed out that informed consent is an important element in Canada's privacy laws.

Vancouver lawyer Allan MacDonald says the form Canada Post uses does not make it clear enough what customers are consenting to. ((CBC))
"Number two, Canada Post should understand in the circumstances that it is disclosing this information to organizations who themselves have not properly obtained consent to collect this information."

Canada Post said it investigates about 10 complaints per year about the system — a tiny fraction of the number of customers who use it.  It said most of the complaints come from people who are in the middle of a divorce, where mail, and its destination, is in dispute.

Funk has now registered her dad's name on the Canadian Marketing Association website as a customer who does not want mail from marketers. She said the junk mail is slowly drying up, but she wants to warn other Canadians about how it affected her family.

"His forwarding address is being sold — and then my box number is being used without my authorization," she said. "I feel absolutely that my privacy was invaded."