PIPEDA Case Summary #2004-258

Courier company amends consent form and improves information-handling practices

[Principles 4.3 and 4.3.2; section 5(3)]

Complaint

An individual complained that a courier company inappropriately collected his personal information when he used its services to send a package to another country, via the United States.

When the complainant presented his package for shipment, a company employee checked the envelope and asked him to sign a form declaring that the package had been inspected and that it contained what was described on the waybill. He was also asked to present two pieces of identification, one of which had to have his photograph. He provided this information but questioned the employee on the reasons for it. He was informed that it was a U.S. Customs requirement. The representative made a photocopy of the identification and attached it to the waybill. The complainant was under the impression that the copy was then inserted into the envelope, although he did not actually see this happen, for possible inspection by U.S. Customs.

While he did not necessarily object to providing the identification, he was very concerned that it could be accessed by anyone en route to its destination.

Summary of Investigation

The company instituted new procedures after September 11, 2001, to detect suspicious shipments and to prevent shipments from being used for any type of illegal activity. These procedures included requiring two pieces of identification, one of which had to have a photograph of the customer. The company also required that customers sign a consent form, after the shipment was inspected and its contents verified. The form and the photocopy of the identification were kept for 30 days — information that was specified on the form. The company was of the view that, since the complainant signed the form, he was aware of the purposes for the collection and consented to it.

At the time of the complaint, however, the form did not, in fact, clearly specify the reasons for the collection of identification. The company did confirm that it is not a U.S. Customs requirement. The employee who had told the complainant this had since left the company and could not be reached for an interview with an investigator. The Office informed the company that regardless of what the complainant was told, the form should explicitly state the purpose of the collection. The company agreed and amended its form accordingly.

As for the complainant's concern that a photocopy of his personal information was attached to his package and was therefore accessible to anyone, the company clarified that its practice was to make only one copy of customer identification, which it kept in a locked file in the manager's office for 30 days, after which time it was shredded. These procedures applied whether the shipment's destination was domestic or international. In this particular case, the company confirmed that the complainant's photocopied material was attached to its copy of the waybill and that it never left the office. It was destroyed after thirty days.

As a result of the investigation, the company decided to discontinue its practice of photocopying customer identification. It now logs this information on the consent form, which is used only for shipments by air.

Findings

Issued January 23, 2004

Application: Section 5(3), which states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances; Principle 4.3, which stipulates that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate; and Principle 4.3.2, which goes on to stress the need for "knowledge and consent." It states that an organization shall make a reasonable effort to ensure that the individual is advised of the purposes for which information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

The Assistant Privacy Commissioner deliberated as follows:

• While the Office was satisfied that a reasonable person would consider the company's purpose for collecting customer information, namely to identify the individual in case there is a security issue with the shipment, to be appropriate, as per section 5(3), it was concerned that the company's consent form was not providing for the meaningful consent of customers, as stipulated in Principles 4.3 and 4.3.2, because it did not adequately specify this purpose.
• Although the complainant had signed the form, the Assistant Commissioner did not consider it a "meaningful consent" since he was not properly informed of the purposes for the collection of his personal information.
• However, the Assistant Commissioner was pleased that the company had since amended its consent form to clearly state the purpose for the collection of personal information. She was also pleased that the company decided to discontinue photocopying customer identification, and that the form has been limited to air shipments only. She noted that the cooperation the Office received from the company was most encouraging.

For these reasons, as well as the fact that the complainant was pleased that his personal information had not in fact been attached to his package, the Assistant Commissioner concluded that the complaint was resolved.