Canada has a thriving technology sector and has a sophisticated legal infrastructure that supports e-commerce, the broadcasting and telecommunications industry, privacy and intellectual property.
Importing certain technologies into Canada may obligate importers to comply with requirements under the Defense Production Act and Controlled Goods Regulations. The Controlled Goods Directorate, which is governed by the Controlled Goods Regulations, is mandated to protect goods and/or controlled technologies within Canada and to prohibit controlled goods and/or controlled technology from being accessed by unauthorized persons.
Canada's export control regime is regulated by multiple domestic laws, international agreements and diplomatic obligations. Export permits may be required to not only ship goods outside of Canada, but to provide services associated with designated technologies, discuss designated technologies with certain employees, participate in phone or video conversations about designated technologies, correspond by email, fax or otherwise through cyberspace about designated technologies, and even before leaving Canada's borders on business trips. Factors such as the nature, characteristics, origin of componentry, uses to be made of the technology, destination and end users of the technology are all relevant to whether an export permit is required.
A key point for U.S. companies working with businesses in Canada is that there are areas of conflict between Canada's export control laws and U.S. export control laws. For example, Canadian companies may be subject to fines and other penalties should they agree to be bound by U.S. export control laws. In addition, directors and officers may face penalties for complying with any instruction by, or policy of, a U.S. entity, contrary to Canada's policies relating to the trading between Canada and Cuba.
Canada's federal government and the Canadian provinces have adopted electronic commerce statutes that deal with issues arising from conducting business electronically. Ontario's e-commerce statute is called the Electronic Commerce Act and Canada's federal act is called the Personal Information Protection and Electronic Documents Act ("PIPEDA"). Canada's e-commerce statutes typically set out standards to be met in order to use an enforceable electronic signature and requirements to be met in order for a document, that would otherwise have to be in writing, be satisfied by communicating such document electronically. These e-commerce statutes also set forth how and when an offer and acceptance of a contract distributed electronically may be made.
Canadian bankruptcy and insolvency laws underwent revisions in 2009 to afford greater protection to licensees of technology. One of the key terms set forth in Canadian bankruptcy and insolvency legislation is that such legislation permits insolvent parties to "disclaim" (terminate) a licence agreement; provided, however, a licensee's right to use the intellectual property cannot be disclaimed.
It is unclear which intellectual property rights enjoyed by licensees are protected from being disclaimed. While one may assume all statutory intellectual property rights would be protected, Canada also enjoys common law intellectual property rights for trade-marks and trade secrets. The legislation provides no guidance as to what the "right to use" (which is afforded protection) means. The legislation does not obligate the licensor to continue to provide maintenance or support should the licensor become insolvent. From a licensor's perspective, there is little, if any, protection should the licensee become insolvent. There can be serious consequences for the licensor arising from the Canadian courts' broad right to assign licence agreements to third parties in the event of an insolvency.
.ca Domain Names
Internet domain names are verbal representations of a numerical address used to identify and locate websites on the Internet. Each internationally recognized country is entitled to one top level domain ("TLD"), referred to as a country code top level domain, or ccTLD. Canada's ccTLD is the .ca domain. The .ca domain is currently administered by the Canadian Internet Registration Authority ("CIRA").
Registration in the .ca domain is available only to applicants who can demonstrate Canadian presence requirements, namely Canadian citizens, permanent residents or their legal representatives, corporations incorporated under the laws of Canada or any province or territory of Canada, trusts, partnerships, associations and other individuals and entities that meet certain requirements. Generally, the registration and transfer processes for .ca domain names are not particularly sophisticated or complicated. Dispute resolution processes in the .ca domain were established in 2001.
Applicability of Sale of Goods Legislation
In Canada, certain rights and obligations will follow the acquisition or sale of technology that falls within the scope of provincial sale of goods legislation. Canadian courts tend to treat computer system acquisitions as sales of goods while transactions involving pure service, maintenance, training or programming are typically viewed as incidental to the sale of goods and therefore not subject to sale of goods legislation. Software supplied solely pursuant to a licence agreement is typically not subject to sale of goods legislation unless some sort of property is transferred to the licensee. If software is provided together with hardware or other goods, the software may be subject to sale of goods legislation.
Libel Action over the Internet
Cyber-libel is a statement or image that has been published on the Internet which tends to lower the reputation of a person in the community. It is still unclear in Canadian jurisdictions as to whether email, blogs and the content of websites constitute a broadcast for the purposes of defamation law. If they do, short limitation periods may apply. As information on the Internet is widely disseminated in a short period of time, there is a high probability of significant damages resulting from a cyber-libel.
An issue that has arisen in the context of cyber-libel is the posting of defamatory statements or images to the Internet anonymously. Although it is possible to obtain early mandatory orders or discovery from third parties that allow one to obtain information that may lead to the identity of the cyber-libeller, it is often an expensive exercise. In addition, this information may not prove to be useful since the publisher may have posted the defamatory statement or image from an Internet café or other public resource, which often does not keep records of its users. While the law in jurisdictions within North America vary by province or state, as a result of a recent Supreme Court of Canada decision, the law in Canada is now closer to that generally applicable in the United States. In Canada, those who post statements and images which are false and defamatory may escape liability if they can demonstrate that the material was published responsibly.
In the United States, ISPs are generally protected from liability in respect to the content of others. In Canada such immunity is less clear.
Assigning and Sublicensing Technology Licences
For a software licence to be assignable, the Canadian courts look to whether or not the licence is "personal" to the parties. If the courts determine that a licence is personal, the licence may not be assignable or capable of being sublicensed to third parties, barring any language in the licence to the contrary.
Enforceability of Shrink-wrap, Click-wrap and Browse-wrap Licences in Canada
The key for enforceability of the shrink-wrap, click-wrap and browse-wrap agreements is whether or not it can be established that both parties to the contract were aware of the terms of the agreement and agreed to them. Canadian courts have tended to favour the forms of agreements where the terms of such agreement are brought to the attention of the person, with the person having to click "I Accept" prior to being bound to such terms, over those forms of agreement where the person is bound by the terms as a result of simply landing on a website.
Use of Non-Canadian Form Agreements in Canada
Foreign technology companies that wish to use their standard commercial precedents to carry on business in Canada should ensure that certain "Canadian-specific" legal issues have been addressed in the form of agreement which is to be used. Some of these issues include the following:
Sale of Goods Act Conditions: Canadian practice relating to technology agreements is to ensure that any disclaimer of implied warranties contained in a technology agreement also disclaims the implied conditions imposed by sale of goods legislation.
Ownership Rights: Canadian copyright law does not recognize the concept of a "work made for hire," which is often contained in U.S.-based agreements. In a software scenario, typically, the author of the computer program is the first owner of copyright in the program. If the author is employed for the purpose of creating software, then the employer will generally be the first owner of copyright in the software. The law is similar for inventions and trade secrets. In a situation in which a copyrighted work is being created for a customer by a contractor, the contractor, as author, will be the owner of the work unless the contractor has entered into a written assignment of such copyright in favour of the customer. It is also standard practice in Canada to have such a written assignment accompanied by an express waiver of moral rights in the work.
Import/Export Law Controls: Canada has its own export control legislation which must be considered when determining export restrictions which must be adhered to by a Canada-based customer.
With a few exceptions, regulation of patents, trademarks, copyright and industrial designs is within the jurisdiction of the Canadian federal government and is adjudicated most commonly in Canada's Federal Court. Canada also affords certain protection for trademarks and trade secrets via Canada's common law or civil law, which is governed by provincial law and provincial superior courts.
The Patent Act provides a system for the issuance of patents for inventions. It grants to a successful applicant an exclusive right for 20 years from the patent's filing date to make, use and sell to others the claimed invention in Canada. A patentable invention is any new, useful and non-obvious art, process, machine, manufacture or composition of matter or any new or useful improvement to any of the foregoing. A patentable invention may consist of a method of application of a new principle or a new method of applying an old principle, as well as a new use for an old chemical compound. Some forms of business method patents are obtainable in Canada.
An invention is not patentable in Canada if it has been disclosed by the applicant in any country more than one year prior to the filing date of the application, or if it has been disclosed by anyone not the applicant prior to its filing.
Canada is part of the Global Patent Prosecution Highway pilot program, in which a final ruling from a patent office in the United States, the United Kingdom, or one of 18 other countries can be used to allow fast track examination of a patent application in Canada – and vice versa.
The Trade-marks Act (the "TMA") provides a system for the registration of trademarks. It grants to a successful applicant an exclusive right for 15 years, subject to renewal, to use the trademark in Canada to distinguish one party's wares or services from those of others. Renewal fees currently are required every 15 years, although legislation has been passed (although not yet in force) to require registrations every 10 years. A trademark may be composed of words or symbols or a combination of both. A trademark may also consist of a distinctive shape, colour or sound. Applications in Canada may be based on actual use of the trademark in Canada, proposed use of the trademark in Canada or registration of the trademark in a foreign country that is a signatory to the Paris Convention. The new legislation is set to remove the use requirement for filing.
A trademark is registrable if it is not: (a) the name or surname of an individual; (b) clearly descriptive or deceptively misdescriptive of its associated wares or services; (c) the name in any language of its associated wares or services; or (d) likely to be confusing with an already registered trademark.
Trademarks may be licensed. The licence should be in writing, and the owner must retain direct or indirect control of the character or quality of the wares or services provided by the licensee under the trademark. Trademarks may be assigned. Any such assignment should be in writing and recorded with the Canadian Intellectual Property Office ("CIPO"). If the licensing or assignment arrangements are improper, the trademark may lose its distinctiveness and the owner's exclusive rights may be lost. Distinctiveness refers to the ability of the trademark to distinguish one party's goods and services from those of others.
In the absence of registration, a trademark can be protected only in the geographical region in which the owner can establish a reputation or goodwill in association with the trademark and the goods and services offered in association with it, which in practice can vary from a neighborhood to the entire country depending on the circumstances.
Large changes to the TMA have been enacted but are not yet in force. These include the ability to file international registrations (i.e., Madrid applications), the requirement to file wares and services (now known as goods and services) according to the international classification schemes and the removal of a use requirement from the filing of trademarks. The regulations putting these changes into force are not yet implemented, but they likely will be by the end of 2015.
The Copyright Act provides protection for authors and creators of original literary, dramatic, musical and artistic works, published or unpublished. Copyright protection extends to any work from the moment that it is created and fixed in tangible form, including computer software. There are also protections for associated rights such as performer's rights and moral rights.
Copyright is the sole right to produce or reproduce the work or any substantial part thereof in any material form in Canada, and it is infringement of copyright for someone other than the owner of copyright to perform an activity that is protected under copyright, without the permission of the owner. It is also an infringement of copyright to provide an Internet-based service (or other digital network service) primarily for the purpose of enabling acts of copyright infringement if an actual infringement of copyright occurs by that same means as a result of the use of that service.
There are some specific activities that would constitute infringement were they not specifically exempt from infringement under the Copyright Act. For example, fair dealing with a work for the purposes of private study, research or criticism, education, parody, satire, review or news reporting does not infringe copyright. Subject to certain conditions, an individual may also use, in a non-commercial context, a publicly-available work for the purpose of creating a new work without constituting infringement. It is also not an infringement of copyright for an individual to transfer legally-obtained works from one format to another for personal use.
For work to be the subject of copyright protection, it must be original. Registration is not required to obtain protection, but is of some assistance to enforce legal rights in a civil action. The author of a work is the first owner of copyright, unless the work was made in the course of employment, in which case the employer is the first owner of copyright unless there was an agreement to the contrary. If the author is an independent contractor, the author is the first owner of copyright unless there was an agreement to the contrary. The term of protection is generally the life of the author plus 50 years. Copyrights may be licensed, exclusively or otherwise, or assigned.
Independent of any rights of ownership of copyright, an author of a work has moral rights in a work. An author's moral rights includes an author's right of paternity (including the right to be associated with his or her work or to be anonymous) and an author's right of integrity (which provides the author with the right to prevent its distortion, mutilation or modification and its use in association with a product, service, cause or institution if such use would result in prejudice to the honour or reputation of the author). Moral rights may not be assigned, only waived in whole or in part. These moral rights are not available in the United States.
A copyright owner may recover between C$500 and C$20,000 for each work in the event of copyright infringements for commercial purposes, and between C$100 and C$5,000 for all works in the event of copyright infringements for non-commercial purposes. Where a work is controlled by a technological protection measure and such measure is circumvented knowingly and for commercial purposes, the person responsible for such circumvention may be liable on conviction on indictment, to a fine not exceeding C$1 million or to imprisonment for a term not exceeding five years or to both; or, on summary conviction, to a fine not exceeding C$25,000 or to imprisonment for a term not exceeding six months or to both.
Computer Programs and Copyright
Computer programs are protected under the Copyright Act as literary works. Updates or enhancements to software are subject to independent copyright protection. The fact that a computer program is created using well-known programming techniques or contains unoriginal elements may not be a bar to copyrightability if the program as a whole is original.
Hardware and Copyright
Written computer hardware designs and plans have received copyright protection in Canada. Further, any software code stored on the hardware may be subject to copyright. Computer chips may be subject to integrated circuit topography protection.
Databases and Copyright
Some databases that contain original content may be given protection as "compilations" under the Copyright Act, although there is no specific database protection, and most databases likely would not be covered by copyright. To obtain protection, databases must be independently created by the author, and the selection and arrangement of the components that make up the database must be the product of an author's exercise of skill and judgment. The exercise of skill and judgment must not be so trivial as to be characterized as a purely mechanical exercise. However, "creativity," in the sense of novelty or uniqueness, is not required. In addition, the creator of the database only acquires copyright in the database and not in the individual components of the database.
Webpages and Copyright
A web page's look, layout and appearance can be protected by Canadian copyright. Most webpages would be considered original works and/or compilations, and are protected by copyright and trademark laws.
Technology Elements Not Protected By Canadian Copyright
Underlying mathematical calculations, algorithms, formulae, ideas, processes, or methods contained in information technology are not protected by Canadian copyright laws, although they may be protected in some cases under patent law. Canadian copyright protects only original expressions of the foregoing.
Amendments to Canadian Copyright Law
Many amendments to the Copyright Act regarding treaty implementation provisions and the adoption of a notice-and-notice regime have been proclaimed into force as of January, 2015. The current notice-and-notice regime provides that an owner of the copyright in a work or other subject-matter may send a notice of claimed infringement to an online service provider whose subscriber has uploaded the allegedly infringing content, and the online service provider will be required to notify the subscriber of the notice of claimed infringement. The online service provider must then retain records identifying the person to whom the notice was forwarded for at least six months. New exceptions to copyright infringement, including for parody and educational purposes, are now part of Canadian law.
The Industrial Design Act provides a system for the registration of designs in any original shape, configuration, pattern or ornamentation applied to an article of manufacture made by an industrial process. It grants to a successful applicant the exclusive right to prevent others from making, importing for trade or business, renting, selling or offering for sale or rent any article in respect of which the design is registered (or a design not differing substantially therefrom) in Canada for a period of 10 years from the date of registration subject to the payment of maintenance fees at the fifth year. Amendments have been passed, although not yet in force, that will change the term of registration to the later of 10 years after the date of registration of the design and the end of 15 years after the filing date of the application. A claim of ownership of a design may only be made if there is a registration of that design under the Industrial Design Act. No claims of ownership may be made without registration. An industrial design is known in the United States as a "design patent."
For a design to be registrable, it must be original (although the standard will change to a novelty standard once the new amendments are brought into force). Industrial designs are directed to an aesthetic feature that appeals to the eye. Features that are entirely functional may not be the subject of registration. Only the owner of a design may apply for and obtain an industrial design registration. If the design was created by an employee of a company, then the employer is considered to be the owner of an industrial design, barring an agreement to the contrary.
An application for registration must be filed within a year of the first publication or sale of the design in Canada by its author. A design is considered "published" if it has been made public or offered for commercial sale or use anywhere in the world.
Industrial design registrations may be assigned or licensed.
International Conventions and Treaties
Canada is a signatory to the North American Free Trade Agreement and is a member of the International Convention for the Protection of Industrial Property which affects patents, trademarks and industrial designs. Canada is a signatory to the Patent Cooperation Treaty, which provides a common system for the filing of a patent application in signatory countries, and is a part of the Global Patent Prosecution Highway pilot program, which allows fast track prosecution of a patent that has been examined by the patent office of any participating country. Canada is also a member of the Berne Convention, the Universal Copyright Convention and the World Trade Organization, each of which bear on protection for copyright owners who are citizens of convention countries.
On January 1, 2015, the Combating Counterfeit Products Act came into force and amended the Copyright Act, the Trademarks Act and the Customs Act. The amendments are aimed at giving the Canadian Border Services Agency additional tools for combatting the import and export of counterfeit goods. New civil and criminal remedies have been created to deal with possession and dealing of counterfeit goods. The changes were brought about by Canada's international obligations under the Madrid Protocol, the Nice Agreement, and the Singapore Treaty.
COMMUNICATIONS LAW AND DIGITAL MEDIA
Canadians have long had a deep fascination with communications which stems, in part, from the geographic and physical situation of Canada, a very large country which spans multiple time zones and features extremely difficult and diverse terrain. Most Canadians live on a narrow "people's belt" along the Canada – U.S. border. This proximity to the United States has a profound influence on Canadians and has given rise to a fixation with concerns related to the preservation of Canada's unique bilingual and bicultural character. These concerns are, in turn, reflected in some of the unique telecommunications and broadcasting regulatory policies summarized below.
Canada's communications environment has been in a rapid state of transition, deregulation and increased competition for more than two decades. In Canada, both telecommunications and broadcasting are constitutionally under the legislative authority of the federal government as the courts have expressly found that broadcasting and telecommunications companies are inter-provincial undertakings. The primary legislative requirements for communications regulation are set out in the Telecommunications Act, the Broadcasting Act and the Radiocommunication Act. The government departments and agencies with key responsibility for administering these areas are the Canadian Radio-television and Telecommunications Commission ("CRTC"), – the regulatory authority in the telecommunications and broadcasting sector, Industry Canada – which is responsible for managing and licensing spectrum to wireless carriers and setting telecommunications policy, including equipment certification guidelines, and Heritage Canada – responsible for cultural issues and broadcasting policy.
Four unique aspects of the communications regulatory regime stand out in particular and are at the centre of current policy debates/considerations:
- The distinction between content and carriage which is evident in the bifurcated legislative provisions but is increasingly difficult to maintain as technologies and businesses converge;
- The foreign ownership restrictions for telecommunications common carriers (entities that own or operate transmission facilities to provide telecommunications services to the public) and for broadcasting companies;
- The liberalized regulatory treatment of certain services provided by telecommunications carriers; and
- Current regulatory exemption for digital media services.
The CRTC has adopted a policy of forbearing from regulating many services provided by telecommunications carriers (e.g., retail wireless rates). Notwithstanding this forbearance, carriers continue to be subject to tariff filing requirements and other ongoing regulatory obligations in areas such as access to support structures and the provision of wholesale Internet access to third parties.
The Canadian communications regulatory and policy environment is constantly evolving. Legislators and regulators are struggling in the face of policy challenges posed by new technologies and new service offerings. The foreign ownership restrictions governing telecommunications carriers (as distinct from broadcasting undertakings) have been the subject of much review and debate, including four separate reports over the past few years. Following several consultation papers and policy review panels, the federal government in 2012 eliminated the foreign ownership rules for investments in Canadian telecommunications carriers whose market share is less than 10% of the total Canadian telecommunications market (as defined by the CRTC).
PRIVACY LAW IN CANADA AND CANADA'S ANTISPAM LEGISLATION
Canada has a growing array of federal and provincial privacy statutes, in both private and public sectors, as well as growing protection over privacy rights throughout the common-law.
Canadian businesses are often subject to multiple pieces of legislation, at the federal and provincial levels, that protect the privacy rights of individuals. For instance, as of January 1, 2004, most Canadians were required to comply with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), which regulates the collection, use and disclosure of personal information in the course of "commercial activities." Legislation substantially similar to PIPEDA exists in various provinces, including British Columbia's Personal Information Protection Act, Alberta's Personal Information Protection Act, and Québec's Act respecting the protection of personal information in the private sector.
Various provinces have also enacted statutes legislating the collection, use and disclosure of personal health information. Most notably, Ontario's Personal Health Information Protection Act ("PHIPA"). PHIPA applies to personal health information regardless of whether the information is used in a commercial context or otherwise.
Depending on the nature of an organization's activities and the use made of Personal Information (as hereafter defined), compliance can be as simple as preparing privacy policies or can involve complex processes such as privacy audits, staff training, implementation of security systems, improvements to storage systems, the implementation of other protective measures, including ensuring contractual provisions exist with third parties who may have access to the Personal Information in the organization's possession or control.
Privacy issues will likely affect an organization (an "Organization" or "Company") in two ways: First, an Organization itself will have to comply with PIPEDA and other privacy legislation with respect to Personal Information on third parties (such as existing or prospective customers) it collects and controls. Federally regulated organizations will have to also comply with PIPEDA in relation to its employee information. To the extent a provincially regulated Organization has employees located in the provinces of British Columbia, Alberta or Quebec, it will need to consider the impact of such provincial privacy laws on employees' Personal Information. Secondly, Organizations will want to ensure that all third parties to whom they grant access to or use of the Personal Information have contractual provisions in place governing the third party's use, disclosure and security around the Personal Information, as well as certain audit rights to ensure such third party complies with its' obligations.
Recently, the Canadian government passed amendments to PIPEDA that, among other changes, introduce mandatory breach notification requirements. These requirements are, as of the date of writing this, awaiting regulations before the breach notification provisions will take full force and effect. Once these provisions come into effect, businesses will have an obligation to report a privacy breach to the Office of the Privacy Commissioner of Canada and the individuals whose information has been breached if there is a reasonable risk of significant harm resulting from the breach.
Overview of PIPEDA
The purpose of PIPEDA is to balance the right of privacy of individuals with the need of businesses to use Personal Information for reasonable purposes in order to operate successfully. "Personal Information" is specifically defined as "information about an identifiable individual." It does not include certain business contact information. It includes such information as race, ethnic origin, colour, age, marital status, religion, education, medical, criminal, employment or financial history, address and telephone number, Social Insurance Number, fingerprints, blood type, tissue or biological sample, and views or personal opinions that are linked to an individual.
PIPEDA now applies to Organizations in Canada that collect, use or disclose Personal Information in the course of all commercial activity. "Commercial activities" are defined to mean "any particular transaction, act or conduct or any regular course of conduct that is of a commercial character."
While some people may believe that the legislation applies only to organizations with a business in Canada, the Federal Court of Canada has held that the federal Privacy Commissioner has a broad right to investigate organizations that collect, use or disclose personal information of Canadians.
What Does An Organization Need to Do?
PIPEDA outlines several key principles to protect Personal Information. It also requires that Personal Information be used or disclosed only for purposes for which it was collected. Once an Organization collects Personal Information, it maintains ongoing obligations with respect to its use and safeguarding.
Be Accountable: An Organization must be responsible for Personal Information under its control and shall designate an individual or individuals who is/are accountable for the Organization's compliance with the following principles.
Identify the Purpose: The purposes for which Personal Information is collected shall be identified by the Organization at or before the time the information is collected.
Be Accurate: Personal Information shall be accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
Be Open: An Organization shall make readily available to individuals specific information about its policies and practices relating to the management of Personal Information.
Give Individuals Access: Upon request, an individual shall be informed of the existence, use and disclosure of his or her Personal Information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
Provide Recourse: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals for the Organization's compliance.
What are the risks if an organization does not comply?
Complaints by individuals are heard by the federal Privacy Commissioner who has the authority to receive and investigate complaints and to try to resolve these disputes (similarly, complaints in the provinces are heard by the relevant provincial privacy commissioner). The Privacy Commissioner also has the right to make public any information relating to an Organization's Personal Information management practices if it is in the public interest to do so. Public disclosure of the details of the complaint can be the most damaging to a business, and is a destructive consequence of misusing Personal Information. The individual making the complaint can also apply to court for damages.
PIPEDA creates offences for obstructing an investigation or audit; destroying Personal Information that is the subject of an access request; or disciplining a whistleblower.
An organization that engages in these activities can be fined up to C$10,000 for a summary conviction or C$100,000 for an indictable offence.
Processing of Personal Information in the United States
As indicated above, an Organization has an obligation to safeguard the Personal Information processes and not to disclose it to third parties without consent.
There is a great deal of sensitivity in Canada regarding outsourcing of any data management services outside the country. Many concerns can be dealt with through adequate data protection agreements combined with appropriate notice requirements.
Data Breach Notification in Canada
Arguably, Canada has had breach notification obligations as long as privacy laws existed. An Organization is not able to use or disclose Personal Information for purposes that had not previously been consented to by the individual, without such individual's notice and consent. However, to clarify and to formalize this, Alberta has mandatory breach notification obligations through its' privacy legislation, as does PHIPA. Mandatory breach notification, at the federal level, was introduced through amendments to PIPEDA and are, as of the date of writing this, awaiting regulations before the breach notification provisions will take full force and effect. Once these provisions come into effect, businesses will have an obligation to report a privacy breach to the Office of the Privacy Commissioner of Canada and the individuals whose information has been breached if there is a reasonable risk of significant harm resulting from the breach.
Common Law Right to Privacy
The common law tort of invasion of privacy continues to develop throughout Canada and the provinces in various ways. For example, in the last few years, Ontario has begun to recognize a common law tort referred as Intrusion on Seclusion.
Canada's Anti-Spam Legislation
On July 1, 2014, the majority of Canada's anti-spam legislation (An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act) ("CASL") came into force. CASL is arguably one of the strictest regimes regulating the communication of commercial electronic messages both in terms of the scope of application, requirements and the penalties imposed upon failure to comply. The legislation requires businesses to comply with its requirements surrounding the sending and disseminating of commercial electronic messages ("CEMs"), including its strict consent and detailed content obligations. This legislation has extremely broad application and includes CEMs sent via email, text, sms, BBM and direct social media communications. CEMs are considered to be messages that encourage participation in a commercial activity and include offering, advertising or promoting a product or service.
As of January 15, 2015, further provisions concerning the unsolicited installation of computer programs and software came into force. These provisions prohibit the installation of a computer program to another person's computing device (such as a smartphone, laptop, or other connected device) in the course of commercial activity without the express consent of the device owner or an authorized user.
The Canadian Radio-television and Telecommunications Commission, the Competition Bureau and the Office of the Privacy Commissioner of Canada jointly enforce Canada's anti-spam legislation. The legislation is enforced through regulatory measures, including steep administrative monetary penalties. Businesses and those who are subject to the legislation, including directors, officers and agents, that do not comply risk significant financial penalties, that can range up to C$1 million per violation for individuals and C$10 million for businesses. CASL will statutorily permit a private right of action for breaching its terms, as of July 1, 2017, which will create further financial repercussions for violations of the legislation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.