New guidance for email marketers was released last week by the Office of the Privacy Commissioner of Canada (OPC). Specifically, the OPC released a Report of Findings, Compliance Agreement and Blog Post regarding the “address-harvesting” provisions under the Personal Information Protection and Electronic Documents Act (PIPEDA).
Last year PIPEDA was amended to place restrictions on the use of address harvesting software. PIPEDA now restricts the collection and use of electronic addresses without consent if the collection occurs through the use of a computer program designed or marketed primarily for use in generating or searching for, and collecting, electronic addresses.
The OPC released the guidance following an investigation into Compu-Finder regarding its privacy and email marketing practices, including the use of address harvesting software. Compu-Finder had used commercial address harvesting software and also developed an in-house software tool that would seek email addresses within websites of companies potentially being interested in its services. The OPC found that Compu-Finder had used email addresses collected using these tools after the amendments to PIPEDA had been introduced and, as a result, did not have consent to use such addresses. The OPC recommended that Compu-Finder destroy email addresses that it does not have consent to use, and refrain from collecting email addresses using address harvesting software in the future.
The new guidance also provides helpful tips for marketers with respect to obtaining consent, using publicly available information, and record keeping.