Posting Electronic Signatures on Parcel Tracking Web Site Violates Canadian Privacy Law

The Privacy Commissioner of Canada has found that a courier company's practice of collecting electronic signatures from parcel recipients and posting them on its parcel tracking Web site, along with the recipient's name and address, violates Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

The Commissioner received two separate complaints about this practice.In the first case, the complainant was told that he could not receive the parcel unless he provided an electronic signature.In the second case, the complainant was surprised to discover that the electronic signature appeared on the Web site, along with his name and address, without his knowledge or consent.When he asked for the signature to be removed, he was told it was not possible.

The company defended its use of the electronic signature, saying that the information was collected and used only for the legitimate purpose of tracking parcels and that customers must enter a Parcel Tracking Number (PIN) to gain access to the Web site.However, there was evidence that, by varying the PIN slightly, one customer could gain access to another customer's information.

The company also said its policy allowed paper signatures as an alternative to electronic signatures, however, the Commissioner found that this policy had not been adequately communicated to company staff or customers.

The privacy principals in PIPEDA prohibit practices which require that an individual consent to the collection and use of personal information as a condition of service, unless the information is required to fulfill explicitly specified and legitimate purposes relating to the service.The Privacy Commissioner concluded that the company had failed to properly inform customers of the use that would be made of their electronic signatures and other personal information and had failed to obtain their consent to that use.The Commissioner concluded that the need to track parcels did not justify the collection and posting of the electronic signatures.He also concluded that providing an electronic signature should not be a condition of providing the delivery service.

Following the complaints, the company changed its policies to allow individuals to have their signatures removed from the Web site on request.The company also agreed to examine alternatives to collecting electronic signatures and posting them to the Web site.

The full text of the Privacy Commissioner's decision can be found at http://www.privcom.gc.ca/cf-dc/cf-dc_020905_e.asp