It's February 2015; a key part of Canada's Anti- Spam Legislation (CASL) – commercial electronic communication – has been in force and effect for approximately seven months and another key part of CASL – installation of computer programs – just came into effect on January 15th.
The result of this legislation was, and continues to be, the outpouring of significant expense of time and money by businesses both in Canada and abroad. Human resources are expended in trying to interpret the legislation and trying to effect wide ranging operational changes needed to comply with CASL, and financially there is the toll resulting from modifying business practices; acquiring new resources, applications and programs to assist in compliance; loss of business resulting from restrictions on existing business practices and, of course, procuring the dreaded legal fees to obtain guidance on CASL's application to specific business practices.
As of July 1, 2014, businesses had to comply with CASL's provisions relating to commercial electronic messages (CEMs). Effective January 15, 2015, if your business installs software or computer programs on another person's computer system, you must now be in compliance with CASL's requirements relating to the installation of computer programs. Like CASL's CEM provisions, the computer programming provisions are extremely broad, vaguely worded, have extra-territorial reach and are cloaked in a labyrinth of compliance obligations.
Section 8 of CASL provides that a person must not, in the course of a commercial activity, install or cause to be installed a computer program on any other person's computer system or, having so installed or caused to be installed a computer program, cause an electronic message to be sent from that computer system, unless: (a) the person has obtained the express consent of the owner or an authorized user of the computer system and complies with ongoing obligations contained in subsection 11(5) of CASL; or (b) the person is acting in accordance with a court order. CASL also mandates additional disclosure and consent requirements be met when the software in question performs certain specified functions, including the collection of personal information from the computer systems.
CASL incorporates the definitions of computer program and computer system, which forms the heart of section 8, from Canada's Criminal Code. Under section 342.1(2) of the Criminal Code, "computer program" means data representing instructions or statements that, when executed in a computer system, causes the computer system to perform a function; and "computer system" means a device that, or a group of interconnected or related devices one or more of which: (a) contains computer programs or other data; and (b) pursuant to computer programs: (i) performs logic and control; and (ii) may perform any other function. These are very broad definitions and include programs incorporated into devices well beyond what is typically considered as a computer, laptop or tablet, such as smart vehicles, smart home appliances and smart energy systems.
A person contravenes section 8 of CASL if the computer system is located in Canada at the relevant time or if the person is acting under the direction of a person who is in Canada at the time when they give the directions.
The one enforcement action under CASL in 2014 was underwhelming and not instructive. The enforcement action was presented as a press release, containing very few facts and providing little guidance to businesses on how common business practices will be viewed by the regulators.
During meetings with the regulators in which they discussed how they will interpret CASL, they seemingly tried to import reasonable interpretations into CASL's breadth and scope. They made efforts to explain what it means to cause to install a computer program. Understanding the scope of what cause to install means is critical to understanding a key part to the application of CASL. The efforts by the regulators to explain this were well intentioned, however, they were not entirely successful when their explanations had to be reconciled with real life scenarios. It is hard not to appreciate the efforts being made to interpret CASL in a reasonable manner, however, when the efforts are met with various standard business practices in today's environment, we are not further along in being able to provide practical direction. We must also keep in mind that the regulator's interpretations are simply verbal expressions of opinions in informal sessions, which opinions are highly disclaimed before made. We are in fact told that the regulators cannot be bound to what they say in these meetings. Further, and most importantly, these verbal opinions are not entirely supported by the language in the legislation.
This does not help organizations and businesses who are expending considerable time and money trying to comply. Businesses can be advised that the regulators may try to import a reasonable scope to CASL's application.
However, because the legislative language doesn't necessarily support these opinions, and because the political environment in which the regulatory views have been offered may change, all advice has to be tempered with that disclaimer. When the potential damages are as significant as they are under CASL, it is extremely important for the regulators to provide businesses with clear, consistent and thoughtful interpretations in a manner which has legal backing.
Practically, we can likely take comfort in some of the regulators' verbal opinions in the short term. There has been an extremely large ground swell of businesses and industries voicing concerns about the impact CASL has on legitimate business practices. It seems unwise for the regulators to poke that fire by coming out with either a tough penalty or an interpretation that would widely impact the foundation of existing business practices. In addition, as passing CASL was in many ways Prime Minister Stephen Harper's initiative for several years, given the impending federal election it would seem unwise for him or his government to alienate the business community, which is an important part of the Conservative government's voting foundation.
What we need now are regulations and amendments to CASL to eliminate inconsistencies in the legislation and formalize the interpretations being given, and to provide clear and comprehensive guidance on which we can rely. For more detailed and practical business direction, we need published results of CASL investigations containing details of various business practices and how the regulators will interpret same. Perhaps 2015 will be the year for this.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
