(Ottawa) Canada Post said Friday it is reviewing how it uses data for personalized marketing campaigns after the Privacy Commissioner found the Crown corporation is gleaning information about envelopes and packages, in violation of the law.

In a report released this week, Commissioner Philippe Dufresne pointed out that Canada Post used the personal information it collects on the outside of envelopes and delivered packages to create postal marketing address lists, which the company Crown then rents to the private sector.

The information collected includes information on where recipients live and their type of online shopping, depending on the source of the packages sent.

However, the commissioner found that Canada Post had not obtained authorization from customers to indirectly collect personal information outside the envelopes it delivers, which constitutes a violation of the Personal Information Protection Act .

In a statement released Friday, Canada Post says it is committed to respecting the Privacy Act and the protections it gives to personal information, and will therefore review its program.

La Poste admits that the public may have concerns and maintains that it will respect the standards that Canadians expect.