As discussed in previous issues of The Cassels Brock Report, Canada has introduced Anti-Spam Legislation ("CASL")1 to address and prohibit spam, spyware, malicious code, botnets and other related network threats. It is hoped that the prohibition of these threats will ensure public trust in the on-line marketplace and encourage the growth of electronic commerce in Canada. Archived articles regarding the progress of CASL in The Cassels Brock Report can be found here: Article #1, Article #2 and Article #3.

Although CASL was granted Royal Assent on December 15, 2010, the legislation has not yet been proclaimed in force. The government's intent is that the Electronic Commerce Protection Regulations prepared by Industry Canada and the CRTC (the "Regulations") must be finalized first. These Regulations are intended to provide clarity and legal certainty to key terms in CASL.

The first drafts of the Regulations faced criticism by industry stakeholders and, as a result, the CRTC and Industry Canada decided to implement certain changes. Although the CRTC registered the final version of its Regulations on March 12, 2012, Industry Canada just released the much anticipated second draft of its Regulations on January 4, 2013 (the "Current IC Draft"). Industry Canada's previous draft of its Regulations was subject to public consultation between July 9, 2011 and September 7, 2011 (the "Consultation Period"), and based on the submissions received, Industry Canada introduced the following changes:

"Personal Relationship"

In the previous draft of the Regulations, the definition of "personal relationship" referred to a relationship between individuals who had communicated with each other within the previous two years, and who had met in person during that two-year period. However, during the Consultation Period, there were concerns that this two-year period was arbitrary and that the definition of "personal relationship" should also extend to "virtual relationships" where individuals had not met in person. 

The Current IC Draft removes the arbitrary two-year requirement from the definition and now has extended the definition to include "virtual relationships".  However, in order to limit abuse of the "personal relationship" exemption, the Current IC Draft includes an option for an individual to expressly opt out of receiving commercial electronic messages ("CEMs") from a sender even if the relationship with the sender meets the definition of "personal relationship".

By broadening the definition of "personal relationship" and providing an opt out right, Industry Canada is relying on the individuals themselves to monitor CEMs sent from people with whom they have personal relationships.

"Excluded Commercial Electronic Messages"

During the Consultation Period, concerns were raised about the broad prohibition on the non-consensual distribution of CEMS, with stakeholders requesting many new exemptions to such CASL consent requirements. As a result, the Current IC Draft attempts to address some of these concerns by providing for the following exemptions to the requirement to obtain express or implied consent from the addressee:

  • CEMs sent by employees, representatives, contractors or franchisees within an organization or between organizations if the organizations have a business relationship at the time the CEM was sent and such CEM relates to affairs of the organization or that person's role, functions or duties within or on behalf of the organization;
  • CEMs sent in response to a request, inquiry, complaint or otherwise solicited by the addressee;
  • CEMs sent by foreign businesses or individuals or sent from foreign computer systems relating to a foreign product, good, service or organization and accessed using a computer system in Canada as long as the sender did not know or could not be reasonably expected to know that such CEM would be accessed by a computer system in Canada.  However, as currently drafted, we believe that this exemption creates some uncertainty as it is not clear if the product, good, service or organization to which the CEM relates must be exclusively provided outside of Canada or if it may be provided in Canada as well.  Furthermore, this exemption may provide a loophole for foreign distributors to send CEMs to email addresses with certain service providers such as Google, Microsoft and Yahoo as the sender could not reasonably be expected to know that such email addresses would be accessed using computer systems located in Canada; and
  • CEMs sent due to legal obligations or to enforce a pending or existing legal right (i.e., copyright violation notice).  Query whether such electronic messages would meet the definition of CEMs under CASL.

In addition, the Current IC Draft provides a "third party referral" exemption. This exemption applies to the first CEM sent by an individual to an addressee following a referral by a third party who has an "existing business relationship", an "existing non-business relationship", a "personal relationship" or a "family relationship" with the sender and the addressee, provided such CEM discloses the full name of the third party whom made the referral and states that the CEM has been sent as a result of the referral. By limiting this proposed exemption to the first CEM, the sender will be required to receive consent pursuant to CASL in order to send a second CEM.     

"Specified Computer Programs"

During the Consultation Period, telecommunication and other network service providers ("TSPs") raised concerns regarding the consent requirements for the installation of software to prevent the unauthorised or fraudulent use of services or systems, or to update or upgrade systems on their networks.

The Current IC Draft addresses these concerns by allowing TSPs to install software without consent where such computer programs: (i) prevent illegal activities which pose an imminent risk to the security of the TSPs' network; or (ii) are required for network-wide systems updates or upgrades.  However, TSPs will still need consent to install any software which merely prevents suspicious legal activities, or updates or upgrades systems that are not network-wide. 

Compliance Guidelines

The CRTC has released two interpretative guidelines to support its Regulations.  To read about these guidelines please read the following Cassels Brock Report article here.

Industry Canada is also exploring the use of interpretational guidelines and other guidance material to address some of the other concerns expressed during the Consultation Period.  Such interpretational guidelines have yet to be drafted by Industry Canada.

Issues not addressed in the Current IC Draft

Industry Canada has also noted that some of the concerns raised by stakeholders were not addressed by the Current IC Draft.  Although a full review of these concerns was undertaken by Industry Canada, and regulatory options were explored, the concerns were determined to be within the intended ambit of CASL itself. In particular:

  • An argument was made that consents obtained under PIPEDA2  should be valid as consent under CASL; however, Industry Canada has stated that CASL is intended to provide a higher threshold for the collection and use of consent for the activities regulated by CASL.  In any event, as CASL will  be subject to a three-year transitional period following its enactment, an implied consent will be provided during such transitional period to those with whom organizations have an "existing business relationship" at the time CASL comes into force.
  • A concern was raised that CASL would restrict the ability of Canadian businesses to send CEMs outside of Canada on behalf of foreign organizations, placing these businesses at a competitive disadvantage; however, Industry Canada determined that such an exemption would create a loophole that could be abused by spammers, as these CEMs would not be subject to CASL.
  • A concern was raised that manufacturers do not always have direct relationships with the end users of their products (i.e., automobile manufacturers), and therefore would not have express or complied consent to send CEMs. According to Industry Canada, CASL allows manufacturers to send CEMs to fulfill their legal responsibilities (as mentioned above), but that an exemption specifically for manufacturers has not been proposed in the Current IC Draft, as it would be far too broad.

Current IC Draft Consultation Period

The Current IC Draft will be open for a consultation period of 30 days, beginning January 5, 2013 and ending February 4, 2013. 

CASL provides a complex regime, including administrative monetary penalties of up to CAD $10 million and the creation of a private right of action.  Accordingly, Canadian businesses are anxiously awaiting the release of the final version of the Industry Canada portion of the Regulations, the last step before CASL may be brought into force.  We will continue to monitor and report on all key CASL developments as they occur.

Footnotes

1 An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act, SC 2010, c 23.

2 Personal Information Protection and Electronic Documents Act, S.C. 2000 c. 5.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.