On December 4, the Federal Government published final regulations (the "Industry Canada Regulations") under Canada's Anti-Spam Legislation (the "CASL"). The release of the Industry Canada Regulations paves the way for the CASL to come into force, which Industry Minister James Moore concurrently announced would largely occur on July 1, 2014, following a period for businesses and consumers to familiarize themselves with the CASL and its regulations. Specific provisions relating to the unsolicited installation of computer programs will only come into force on January 15, 2015, and the private right of action contemplated by the legislation will not become effective until July 1, 2017.
Since first being enacted in 2010, the CASL and its draft regulations have been subject to significant criticism and debate by businesses and other stakeholders, resulting in numerous delays in their coming into force. The final Industry Canada Regulations, which set out certain exemptions to the CASL and conditions for the use of consent obtained to send electronic messages pursuant to the law, attempt to address certain of these stakeholder concerns. Separate regulations, published by the CRTC and finalized in March 2012, address the required form and content of electronic messages sent and consent obtained pursuant to the CASL.
A summary of the CASL, the Industry Canada Regulations and their impact on businesses in Canada is set out below.
Canada's Anti-Spam Legislation
Intended to be one of the most rigorous anti-spam laws in the world, the CASL prohibits the transmission of any "commercial electronic message" unless the express or implied consent of the recipient has been obtained and the message is in a prescribed form.1 A "commercial electronic message" is defined broadly as a message sent by any means of telecommunication, including a text, sound, voice or image that, having regard to the content of the message, would be reasonably concluded as having for its primary purpose, or one of its purposes, encouraging participation in a commercial activity, including, among other things, a message that offers to purchase, sell or lease a product or service. It would also generally include an electronic message that contains a request for consent to send an otherwise prohibited message.
The express consent requirements are more onerous than those otherwise applicable in the privacy law context and it is expected that many companies' current practices for obtaining consent to collect and use personal information will need to be revised in light of these requirements. The categories of implied consent are limited to where there is an "existing business relationship" and or an "existing non-business relationship" and contain a two-year sunset period, following which consent (express or implied) must be obtained anew.
The CASL also contains provisions prohibiting persons, in the course of a commercial activity, from installing or causing to be installed a computer program on any other person's computer system unless express consent has been obtained.
Maximum penalties for a violation of the CASL are $1 million for individuals and $10 million for corporations. Officers, directors, agents and mandataries of a corporation who directed, authorized or consented to the commission of a violation may also be liable unless they establish that they exercised due diligence to prevent the commission of the violation. The CASL also provides for a private right of action for persons affected by a violation of the law, expected to come into force on July 1, 2017. The maximum amount a private applicant may be entitled to for receiving a commercial electronic message in violation of the CASL is $200 for each violation, not exceeding $1 million for each day.
Davies' prior Flash on the provisions of the CASL itself is available on our website.
Amendments to Other Legislation
The CASL's coming into force will also result in amendments to other legislation, including to the Personal Information Protection and Electronic Documents Act ("PIPEDA") in order to give the CASL paramountcy over PIPEDA in the case of any conflict and, essentially, to make it illegal to collect electronic address information using a computer program or to collect personal information over a network, in each case in contravention of any act of Parliament. Enactment of the CASL will also result in amendments to the Competition Act that will prohibit any false or misleading representations (whether or not material) in sender information, subject matter information or locator (URL) information contained in electronic messages.
Industry Canada Regulations
The CASL contains various exemptions to the consent and form requirements imposed on a sender of a commercial electronic message, including, for example, exemptions for a commercial electronic message that is sent by or on behalf of an individual to another individual with whom they have a personal or family relationship, or that is sent to a person who is engaged in a commercial activity and consists solely of an inquiry or application related to that activity.
The Industry Canada Regulations, which update but remain quite similar to the most recent draft regulations issued in January 2013, define the terms "personal relationship" and "family relationship" as follows:
- "Family relationship" is intended to be broad and is defined as a relationship between individuals who are related to one another through a marriage, common-law partnership or legal parent-child relationship provided that those individuals have had direct, voluntary, two-way communication.
- "Personal relationship" is similarly expansive and includes individuals who have had direct, voluntary, two-way communication and for whom it would be reasonable to conclude have a personal relationship, taking into consideration a number of factors, including the sharing of interests, frequency of communications and length of time since the parties communicated.
In order to address certain stakeholder concerns about the scope of the CASL (and prior draft regulations), the Industry Canada Regulations also contain a number of additional exemptions to the commercial electronic message consent and form requirements, including exemptions for commercial electronic messages:
- that are sent within organizations or between organizations that already have a relationship, where the messages are sent by an employee or other representative and are relevant to the activities of the organization that receives the message;
- that are sent over closed messaging systems (e.g., messages on user accounts on bank websites);
- that are sent to satisfy legal obligations;
- if the person who sends the message (or causes or permits it to be sent), reasonably believes that the message will be accessed in one of 116 foreign states listed in a schedule to the Industry Canada Regulations and the message conforms to the law of that foreign state; and
- that are sent by or on behalf of a registered charity provided the primary purpose of the message is to raise funds for the charity.
The Industry Canada Regulations also exempt from the consent requirements of the CASL the first commercial electronic message that is sent following a referral by any individual who has an existing business relationship, existing non-business relationship, family relationship or personal relationship with the person who sends the message as well as any of those relationships with the individual to whom the message is sent, provided that the message discloses the name of the individual who made the referral and states that the message is sent as a result of the referral.
Further, the Industry Canada Regulations contain a provision stating that, where a sender of a commercial electronic message obtains consent from an individual to allow third parties to send commercial electronic messages to that individual, any subsequent message from the third party to the individual must provide the opportunity for the recipient to withdraw consent from all third parties. This requires persons using this form of consent to send commercial electronic messages to be able to alert the original requester that the recipient's consent to receive messages from third parties has been withdrawn.
The publication of the Industry Canada Regulations and the announcement of a date for the CASL to come into force brings to close an almost decade-long legislative process. The final Industry Canada Regulations have been revised from initial drafts. Nevertheless, there remain concerns raised by various stakeholders about the potential chilling effect the law could have on many common business practices that are not intended to be caught by anti-spam legislation. In light of the incoming legislation, affected companies should examine their policies and practices to determine whether and what changes are required in order to comply with the CASL and its regulations.
1 The provisions relating to commercial electronic messages apply only where the message is sent from Canada or accessed in Canada. They do not apply where the commercial electronic message is simply routed through Canada.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.