Canada has several privacy laws regulating the collection, use, and disclosure of personal information in the course of commercial activities. Under Canada’s private sector privacy laws, personal information is not allowed to be passed back and forth across the border unless the individual is notified. As alarming as this may sound if you’re a Canadian business using a US-based address validation service to validate customer addresses, rest assured that this is NOT an issue with Address Validation since address data does not fall in this category.
Canada’s federal Personal Information Protection and Electronics Document Act (PIPEDA) applies in all provinces that lack their own substantially similar legislation. Currently, British Columbia, Alberta, and Québec all have substantially similar legislation covering private sector privacy issues. In general, personal information is defined as “information about an identifiable individual.”
Service Objects has many clients in the US and Canada who call our real-time APIs to validate both USA and Canadian mailing addresses in order to improve deliverability rates and cut waste. Because privacy is always a concern whether there’s a law in place or not, they’re right to wonder if using address validation infringes upon their customers’ privacy. Rest assured, it does not.
We do not see or store the data in any way
Among the finer points of the law is the distinction between “transfer for processing” and “disclosure.” According to the Office of the Privacy Commissioner, PIPEDA does establish rules governing transfers for processing. A transfer for processing is a “use” of the information; it is not a disclosure. Assuming the information is being used for the purpose it was originally collected, additional consent for the transfer is not required.”
Thus, if you originally collected address information for delivering a product your Canadian customer ordered, having a US-based address validation service process that address to verify its deliverability is a use — as intended. It is not a disclosure. And again, we never see or store the data.
If you need to validate a Canadian or US address and want extra assurance that you are not compromising your customer’s privacy or running afoul of Canada’s private sector privacy laws, you could simply pass only the address. There’s no need to pass a name with the address.
We understand — and share — your concerns about customer privacy. It’s an issue we take seriously and proactively address.
Try out DOTS Address Validation – Canada 2 for free for 30 days and let us know what you think: