Canada: Industry Canada Issues Revised Anti-Spam Regulations

On Jan. 5, Industry Canada published the long-awaited revised version of its Electronic Commerce Protection Regulations. These Regulations, together with the final Regulations previously published by the Canadian Radio-television and Telecommunications Commission (CRTC), will provide the requirements for complying with Canada's Anti-Spam Legislation (CASL) when it comes into force.

The revised Regulations provide important new exceptions that will be essential for businesses in complying with CASL. Industry Canada notes that these have been introduced in areas where "broad application of the Act would otherwise impede business activities that are not within the intended scope of the legislation."

However, the regulatory impact analysis for the Regulations also directly states that some regulatory concerns raised by interested parties in the consultation process were considered but expressly rejected. In particular, Industry Canada has stated that the existing consent that is valid under the Personal Information Protection and Electronic Documents Act (PIPEDA) will not survive CASL in some cases.

Notable aspects of the new Regulations include:

  • New exceptions for the requirements for consent and prescribed disclosure in messages:
    • Sent between employees, representatives, contractors or franchisees of a business and in relation to its affairs;
    • Sent between employees, representatives, contractors or franchisees of separate businesses with an existing business relationship and in relation to their affairs; or
    • Sent in response to a request, inquiry, complaint or solicitation;
  • A new definition of "personal relationship" that removes the requirement to have met in person and to have had a two-way communication in the previous two years;
  • A new — and limited — exception for referral messages sent by an "individual" following a referral from a second individual who has an existing relationship with both the sender of the message and the individual referred.

PIPEDA consent

The regulatory impact statement for the new draft Regulations confirms that Industry Canada takes the position that organizations will not be able to rely on consent (which presumably includes express consent) that was valid under PIPEDA to continue to send messages under CASL when it comes into force.

CASL creates a higher threshold for consent to use information for the sending of commercial electronic messages by requiring specific disclosure set out in the Act itself and the CRTC regulations. Previously obtained consent that did not meet these requirements may not be valid when CASL comes into force and following the transition period.

Instead of relying on existing consent, organizations will have the option to seek additional consent that is valid under CASL or, in more narrow circumstances, to rely on one of the exceptions under the Act. CASL provides a three-year transition period in cases where an organization has an "existing business relationship" as defined in CASL (but without regard to the time limitations typically applicable to the definition) that includes the sending of commercial electronic messages when the Act comes into force.

Prior to CASL coming into force and during the three-year transition period in cases where there is an "existing business relationship," organizations will have an opportunity to confirm that their consent lists are in compliance with the CASL consent requirements. Unfortunately, non-responses to such attempts can be expected to lead to a loss of the ability to use a significant portion of existing consent lists obtained in compliance with the existing law following the transition period when CASL comes into force.

New exceptions

The new draft Regulations create a series of message categories that will be excluded from both the consent and disclosure requirements under CASL. In particular, internal business communications sent between employees, representatives, contractors or franchisees of an organization where the message relates to the affairs of the organization will not be caught. External communications between employees, representatives, contractors or franchisees of separate businesses that are already in a business relationship will also be excluded, provided the message relates to the affairs of the organization or the recipient's role or duties within it.

The draft Regulations also create a broad exception for messages that are sent in response to a "request, inquiry, complaint" or another "solicitation" from the recipient of the message. Previously, businesses would have had to rely on such inquires or solicitations creating an "existing business relationship" stemming from an "inquiry or application" from the message recipient in order to have "implied consent" to respond. However, that approach was problematic in a number of respects, particularly due to the narrow wording "inquiry or application," as well as the requirement that the inquiry or application be specifically related to the purchase, bartering, or lease of products, goods, services, or land, or the acceptance of a business investment or gaming opportunity.

Implied consent in cases of an "existing business relationship" remains in the legislation itself; however, the broader exception now provided for in the draft Regulations will be helpful for manufacturers and other organizations that would typically distribute their products through third parties such as retailers rather than directly to consumers.

For example, a food manufacturer would typically distribute its products through retail grocery stores, which would in turn sell them to consumers. This exception should ensure that responding to questions or comments on a brand's Facebook wall, for example, will not be caught by CASL. That said, it should be noted that Industry Canada expressly declined to create an exception that would bring manufacturers within CASL's definition of "implied consent" based on an "existing business relationship" more generally — unless the manufacturer is able to establish a direct relationship with the message recipient or an exception to the need for consent in the first place.

An organization outside of Canada that sends electronic messages relating to goods, services or organizations outside of Canada will be exempt from the consent and disclosure requirements if the organization "did not know and could not reasonably be expected to know" that the message would be accessed using a computer system in Canada. This provision will provide an exception to general, broad application of CASL, which captures commercial electronic messages that are sent or accessed using a computer system in Canada.

For example, organizations operating solely in the United States are now clearly excluded from the application of the Act in the case of an American customer who receives a commercial electronic message while travelling in Canada. However, if such an entity knew or could be reasonably expected to know that its messages would be received in Canada, the CASL requirements would apply regardless of the fact that the message is sent from a computer in the United States.

However, Canadian businesses sending commercial electronic messages to recipients known to be outside of Canada will still be required to comply with the CASL requirements, regardless of (or in addition to) any local requirements. While Industry Canada indicates that this is a deliberate choice in drafting the Regulations, it appears to impose a significant burden on legitimate businesses — which may now be required to comply with two or more differing standards when sending messages from Canada to other jurisdictions — while failing to deter illegal spammers who would be likely to ignore the law in any event.

Finally, more narrow exceptions to the consent and disclosure requirements will exist in cases where a commercial electronic message is sent to satisfy a legal obligation, or to enforce or provide notice of a legal right.

Family, friends and a very limited referral exception

The revised Regulations also include definitions for "family relationship" and "personal relationship." Commercial messages sent "by or on behalf of" a person with a family or personal relationship will be exempt from both the consent and disclosure requirements of CASL. The definition of "family" relationship tracks that of the 2011 draft of these Regulations, and will include people who have a "blood relationship" descending from a common grandparent, as well as family relationships arising though marriage, common-law partnership and adoption.

The definition of "personal relationship" has been significantly revised and no longer includes a strict requirement for a face-to-face meeting or a two-way communication within the previous two years. Instead, the new proposed definition will apply only to persons who have had "direct voluntary two-way communications," with the number of "communications" required not specified.

If that criterion is met, the individuals will have a "personal relationship" if it is reasonable to conclude their relationship is personal, considering all relevant factors such as shared interests, experiences, opinions, the frequency of their communications and the length of time since they have communicated.

Notably, this definition in now broad enough to capture people who are "friends" through social media, which was a frequent criticism of the previous proposal, which would have excluded pen pals, social media friends, or other friends who had not met in person. However, businesses should note that this definition also relies wholly on factors outside of their direct knowledge and that the Regulations expressly provide that a person may indicate they no longer wish to receive commercial messages from a person even if they remain "friends" through a personal relationship within the definition in the Regulations.

The draft Regulations rely on these definitions to create a new exception to the requirement for consent to send commercial electronic messages following a referral. However, this exception is worded in a narrow manner that would appear to seriously limit its applicability to many "refer a friend"-type promotions if retained in its current form.

As drafted, this exception would apply only to the first message sent by an "individual" to a recipient who was referred to the individual that sends the message by a referrer that has a relationship — either a business or non-business relationship as defined in CASL, or a personal or family relationship as defined in the Regulations — with both the recipient of the message and its sender. Messages sent under this exception would be required to disclose the full name of the person who made the referral.

This exception appears to be severely limited in its application due to the use of the word "individual," which may be read as referring only to natural persons rather than the broader "person," which is defined in CASL to include both "individuals" and legal persons such as corporations and other organizations.

The regulatory impact analysis does not discuss this limitation nor explain the policy basis for excluding corporate entities from an exception that applies only to the first message sent to a recipient following a referral from a person who has an existing relationship with both the sender of the message and its recipient. It is not clear why the Regulations would not recognize that a consumer could as easily and legitimately refer a friend or family member to a trusted corporation as to an individual business person.

Consent sought on behalf of unknown parties

The draft Regulations also detail the permissible uses of a consent obtained on behalf of unknown third parties, such as a commercial email-list broker. The person who obtains such a consent may authorize another to use it on the condition that any commercial electronic messages sent identify the person who obtained the consent and include an unsubscribe mechanism that allows the recipient to withdraw their consent from: a) the person who sent the message, b) the person who obtained the consent, or c) any other person who is authorized to use it.

This provision would place additional compliance requirements on purchasers of commercial email lists, as it would require them to create an unsubscribe mechanism that not only applies to the sender's messages, but also allows the recipient to inform the third-party list provider who initially obtained the consent that it has been withdrawn. Industry Canada states that it has considered this issue but has decided to favour clear disclosure of how consent obtained in this manner is used, as well as a clear consent-withdrawal mechanism.

Comment period

Industry Canada has provided that interested individuals have a 30-day window during which to comment on the draft Regulations, running from Jan. 5 to Feb. 4, 2013.

Following this period of public consultation, final amendments may be made to the Regulations before they are finalized. No coming-into-force date has been published for CASL; however, it is expected to come into force sometime in 2013.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
Similar Articles
Relevancy Powered by MondaqAI
Blake, Cassels & Graydon LLP
Blake, Cassels & Graydon LLP
 
In association with
Related Topics
 
Similar Articles
Relevancy Powered by MondaqAI
Blake, Cassels & Graydon LLP
Blake, Cassels & Graydon LLP
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
 
Email Address
Company Name
Password
Confirm Password
Position
Mondaq Topics -- Select your Interests
 Accounting
 Anti-trust
 Commercial
 Compliance
 Consumer
 Criminal
 Employment
 Energy
 Environment
 Family
 Finance
 Government
 Healthcare
 Immigration
 Insolvency
 Insurance
 International
 IP
 Law Performance
 Law Practice
 Litigation
 Media & IT
 Privacy
 Real Estate
 Strategy
 Tax
 Technology
 Transport
 Wealth Mgt
Regions
Africa
Asia
Asia Pacific
Australasia
Canada
Caribbean
Europe
European Union
Latin America
Middle East
U.K.
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions