Canada: Spammers Beware!

On March 9th, Yahoo! Inc. (Yahoo) filed a complaint in United States District Court alleging that three Canadian individuals, and the businesses operated by them, had violated the U.S.Federal antispam legislation.This case, and other cases that were brought that same day by other ISPs, highlight the high costs which spam imposes on the users of e-mail systems and the providers of e-mail services. Studies have estimated that the total costs associated with the many billions of spam e-mail messages that are circulated every day, exceeded US$10 billion in 2003.

Many jurisdictions, including the European Union and many U.S. states, have enacted laws to address the spam problem.The United States Federal law, Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, 15 U.S.C.§7704 (CANSPAM), which came into force on January 1, 2004, is one of the most recent additions to the potential sources of legal recourse to the spam problem.

In its complaint,Yahoo is alleging that Eric Head, Matthew Head and Barry Head, who are residents of the Kitchener area, and various businesses operated by them, have violated CAN-SPAM, the Computer Fraud and Abuse Act, the California Computer Crime Statuteand are also guilty of civil conspiracy.The complaint asserts jurisdiction on the bases that: the defendants have purposefully engaged in business activities in California; have availed themselves of the benefit of conducting commercially-related activities in California; and have committed tortious acts within the State targeted at California residents. The complaint alleges that since January 1, 2004, the defendants have generated and sent tens of millions of unsolicited bulk commercial e-mail messages to Yahoo users in violation of the above-noted laws. Yahoo is seeking injunctive relief, statutory damages and aggravated damages in respect of the alleged breach of CAN-SPAM.

Despite findings of a recent study by software firm Sophos PLC that Canada was the second most common source of spam after the United States, the Canadian government has been slow to respond, it being a private Senator and a private Member who have brought forward draft anti-spam bills. No Canadian bills have been advanced by Ministers of the government this year.The two antispam bills that were reintroduced in the Senate and House of Commons in February are: Bill S-2 (formerly Bill S-23), An Act to Prevent Unsolicited Messages on the Internet; and Bill C-460, An Act to Amend the Criminal Code (Unsolicited Electronic Mail). Both have received first reading.

Despite these new bills,which are currently not laws, it is important to remember that Canada has other legislation that may prohibit spam in certain circumstances. For example, private-sector privacy legislation such as the Federal Personal Information Protection and Electronic Documents Act(PIPEDA), applies to the collection, use and disclosure of personal information by all organizations in the course of commercial activities."Personal information" under that statute would include e-mail addresses generally, and may include business e-mail addresses. Sending unsolicited e-mails to an individual (whether acting in a personal or sole proprietorship capacity, and possibly as a principal or employee of a business) would constitute a "use" of personal information, which requires consent of the individual (which may be implied in certain circumstances). The Criminal Codealso contains offences dealing with mischief, fraud and computer-related abuses to which spammers may be subject. Misleading or deceptive e-mail may also be subject to the Competition Act, which contains both civil and criminal sanctions.

E-mails that market certain regulated subject matter, such as pharmaceuticals, gambling, tobacco and alcohol, may also be restricted by various Federal and Provincial/Territorial legislation.

Spam may also be controlled by restrictions in contracts with ISPs and electronic mail service providers and by various selfregulatory codes, such as the Canadian Code of Advertising Standards, the Canadian Marketing Association’s Code of Ethics and Standards of Practice and the Canadian Code of Practice for Consumer Protection in Electronic Commerce, which establish business practices with respect to e-mail advertising or soliciting.

Bill S-2 defines spam as "one or more unsolicited messages sent and received on the Internet, but does not include a message sent by a person to another person with whom they have an existing commercial or personal relationship". Unsolicited text messages sent over other digital networks that are not part of the Internet, such as wireless data transmitted to cell phones or PDAs, might not be caught by this bill.

Under Bill C-460, spam is a message transmitted electronically, by means of telecommunication facilities or the Internet: (i) sent by a sender to a recipient with whom the sender does not have a pre-existing business relationship, but excluding a message sent by a sender who has an existing personal relationship with the recipient; or (ii) whose primary purpose is the advertisement or promotion of a commercial product or service and that was not sent as a result of a prior request or with the express consent of the recipient.

It is not clear how a "relationship" will be determined and therefore some unsolicited e-mail may be excluded from the application of the bills.The Canadian Code of Practice for Consumer Protection in Electronic Commerce provides that a consumer, who merely visits, browses or searches a vendor’s Web site, will not have established an existing relationship.

Section 11 of Bill S-2 sets out a number of offences, including: (i) not identifying the e-mail as spam; (ii) sending spam to an address on the "no-spam list", discussed below, or to a recipient who has sent an opt-out message to the sender; (iii) not including a means for the recipient to opt-out of receiving the spam; (iv) sending spam that does not show the address of the sender; (v) sending spam that offers goods or services on behalf of an unidentified third party or that contains false statements about the goods, services or sender’s address; and (vi) the collection, offer or sale of Internet addresses for the purposes of enabling any person to send spam.

On the other hand, Bill C-460 would amend the Criminal Code to create two new offences for sending unsolicited electronic mail and selling electronic mail addresses, without the prior consent of the persons affected.

Under both bills, there may be some problems with the liability of senders who did not create the spam, e.g., where an employee or subcontractor acted on the instructions of its employer or a third party. Bill C-460, however, does provide for a defence for ISPs and for persons exercising due diligence, which is not defined.

The offences in Section 11 of Bill S-2 would apply to foreigners who send spam to Canada, since the bill provides that regardless of where the e-mail message is initiated, if it is received by a person in Canada, it is deemed to have been sent to that person and the act of sending it is deemed to have been effected in Canada. However, it is not clear whether the use by a Canadian of an e-mail mailbox on a server or through an ISP located outside Canada, would constitute receipt by a person in Canada.

Bill S-2 would also regulate ISPs by allowing the Minister of Industry to establish a Council, of which all ISPs must be members, to set standards and procedures to reduce spam.The Council would also administer a "no-spam list" onto which any person may request to be included. Section 12 of Bill S-2 would also impose liability on ISPs if they: (i) are accessories to any of the Section 11 offences; (ii) fail to install spam filters that meet the requirements of the bill and the standards to be set in the by-laws of the Council; or (iii) fail to use reasonable efforts to prevent spam from going to their customers. However, ISPs would be protected from liability for loss or damage to any person arising from the refusal or cancellation of service or access, as a result of that person having committed an offence under this bill or having sent to the ISP an e-mail that the ISP has reasonable grounds to believe is spam. Unfortunately, the bill fails to address the issue of ISP liability for loss or damage that customers may suffer from not having received an important e-mail as a result of the requisite use of a spam filter.

Under Bill C-460, an ISP would not be considered a sender of spam, and hence not liable, if their role is limited to handling, transmitting or relaying the original message.

The minimum penalty under Bill S-2 is a fine not exceeding $500, however it is not clear if that is per e-mail sent, received, collected or sold.The penalty is more severe and may also result in imprisonment in respect of messages involving pornography, explicit sexual activity or attempted fraud (potential fine of $1,000 and/ or imprisonment for up to 6 months) or that target children or schools (except post-secondary) as receivers (potential fine of $5,000 and/or imprisonment for up to 1 year). Directors, partners or officers of a business may also be personally liable if the court finds that the person ordered the spam or had knowledge of it going to be carried out and tolerated it.

Bill S-2 also establishes a civil cause of action in nuisance for sending excessive spam and deems damage to have been caused, without it specifically being proved, if the volume is sufficient to cause inconvenience.The court may award both general and punitive damages in such case. Bill C-460 provides for a sentence of imprisonment (2 years for a first offence and 5 years for a subsequent offence) or a fine ($250,000 for a first offence or $500,000 for a subsequent offence) or both for a person convicted of either one of these offences. However, no proceedings under this bill can be instituted without the consent of the Attorney General of Canada.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.