Effective January 15, 2015, additional provisions in Canada's anti-spam law or CASL will impose restrictions and requirements for the installation and use of computer programs on another person's computer system. The rules will apply to almost any computer program, not just malware/spyware/harmful programs, installed on almost any computing device, including smart phone and tablets, as part of a commercial activity. The rules are challenging to interpret and apply.
On November 10, 2014, the Canadian Radio-television and Telecommunications Commission ("CRTC") published a guidance document entitled "CASL Requirements for Installing Computer Programs". Following is a summary of key parts of the Guidance Document:
Self-Installed Software: the CASL rules do not apply when the owner or authorized user of a computer or device installs a computer program on the computer or device. The guidance document gives examples: (1) the owner of a mobile device accesses an online app store and downloads and installs an app on the device; (2) the owner of a computer buys software on a CD and installs the software on the computer; (3) the owner of a device downloads software from a website and installs it on the device; (4) a business installs software on business devices used by the business's employees; and (5) the owner of a computer uses an offline process to install a computer program on the computer.
Owner/Authorized User: the "owner" or "authorized user" of a computer or device includes any person who has permission to use the computer or device. The guidance document gives examples: (1) if an employer provides a device to an employee, then the employer is the owner of the device and the employee is the authorized user of the device; (2) if an individual owns a computer but provides it to their child, spouse, or other relative for their sole use, then the child, spouse or other relative is the authorized user of the computer; (3) if a person leases a device, then the lessor is the owner of the device and the lessee is the authorized user of the device; and (4) if a device is sent out for repair, then the person conducting the repair is an authorized user of the device, but only to the extent that they perform the agreed-upon repairs to the device.
Cause to be installed: CASL's rules apply when a person, in the course of a commercial activity, either "installs" or "causes to be installed" a computer program on another person's computer system. The CRTC guidance document gives examples of when a computer program is "caused to be installed" – malicious or concealed software that is automatically installed without the user's knowledge when the user attempts to install other software or inserts a music CD into their computer.
Deemed Consent for Certain Programs: CASL provides that a person is considered to expressly consent to the installation of certain kinds of computer programs (e.g. a cookie or Javascript) if the person's conduct is such that it is reasonable to believe that the person consents to the program's installation. A person will not be considered to have consented to the installation of a cookie or Javascript if the person has disabled those items in their browser software.
Additional Definitions: The Guidance Document provides definitions and examples of some important terms used in CASL – "cookie" is defined as a non-executable computer program that cannot carry viruses and install malware; an "update" or "upgrade" makes changes to or replaces a previously installed computer program (e.g. a replacement of a computer program with a newer or better version, in order to bring the program up to date or to improve its characteristics); updated or refreshed data displayed by a computer program (e.g. refreshed weather forecast data in a weather app or refreshed television listings in a programming guide) are not updates or upgrades for the purposes of CASL.
Consent: a person who seeks and obtains consent to the installation of a computer program has the burden of proving the consent, and therefore should keep a record of the consent.
Updates/Upgrades: the CASL rules apply to the installation of updates or upgrades to computer programs, subject to limited exceptions. Consent to install an update or upgrade on another person's computer or device may be obtained in various ways, including when a person obtains consent for the installation of the original computer program. In some circumstances CASL will require consent for the installation of updates or upgrades to a computer program on another person's computer or device even if consent was not required for the installation of the original computer program (e.g. if the original computer program was self-installed by the owner or authorized user of the computer or device).
CASL's software installation rules remain challenging to interpret and apply. Click here for a more extensive review of the Guidance Document and information provided On November 11, 2014 at a CRTC presentation regarding the CASL rules.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
