Canada Post says it is reviewing how it uses data for tailored marketing campaigns after the federal privacy watchdog found the post office was breaking the law by gleaning information from the outsides of envelopes and packages.

Privacy commissioner Philippe Dufresne said in a report released this week that information collected for the post office's Smartmail Marketing Program includes data about where individuals live and what type of online shopping they do, based on who sends them packages.

The information is then used to help build marketing lists that Canada Post rents to businesses.

The commissioner found Canada Post had not obtained authorization from individuals to indirectly collect such personal information, a violation of Section 5 of the Privacy Act.

In a statement today, Canada Post says it is committed to the privacy law and the protections it places on personal information, and will therefore review its data services program.

The post office says it understands the public might have concerns and that it will live up to the standards that Canadians expect.