On January 15, 2015, the provisions of Canada's Anti-Spam Legislation ("CASL") related to the installation of computer programs came into force. Companies that are directly or indirectly in the software/ app business should take note. Generally, going forward, installing or directing (or aiding, inducing or procuring) the installation of a computer program (or updates/upgrades) on the computer system of another person without that person's prior consent will be a violation of CASL.

Violating CASL should not be taken lightly – CASL provides for administrative penalties of up to $1 million per violation for individuals and $10 million per violation for corporations. As a result, companies should consider reviewing and making updates to their software license agreements and terms of use documents in order to ensure that they are compliant with CASL.

CASL doesn't apply to all software installations. CASL only applies to the installation of a computer program if the subject computer system is located in Canada at the time of installation or if the person installing or causing the program to be installed is in Canada at the time of the installation (or direction of the installation). As well, CASL only prohibits installation of a computer program on the computer system of another person. Computer programs installed on a computer system by an owner or authorized user of the computer system (a "User") would not be restricted by CASL so long as the computer program performs functions that the User would reasonably expect. As an example, firmware installed by a manufacturer at the time of device production would not be governed by CASL as the computer system would be owned by the manufacturer at such time (similarly, CASL wouldn't restrict the installation of computer programs by businesses on owned devices that are used by their employees). CASL does, however, restrict the installation of unexpected or secondary concealed functions whether or not a User installs the software. This restriction demonstrates one of the driving purposes of the legislation – limiting the spread of malware and spyware.

If CASL does apply, the User's consent must be obtained prior to installation. CASL's consent request requirements for software mirror CASL's consent request requirements for sending commercial electronic messages. A request for consent must clearly and simply state: the purpose of the consent; who's seeking consent and their full contact information; that consent can be withdrawn; and a general description of the functions and purpose of the computer program to be installed. Fresh consent isn't required to install an update or upgrade if it was expressly consented to when the computer program was first installed, if the User is entitled to receive the update or upgrade under the initial consent, and if the update or upgrade is installed in accordance with the terms of the initial consent.

There are certain situations where consent to the installation of a computer program is implied. Consent is implied where a bug fix or patch is installed as a reactive or proactive step taken to correct a failure in the operation of a computer system or a program installed on it, so long as the installation is solely for that corrective purpose and is consistent with consumer expectations. As well, consent is implied where a computer program is only executable using another computer program, the installation of which was previously consented to. It must, however, be reasonable to believe from the User's conduct that that the User consents to the program's installation. For example, it wouldn't be reasonable to believe that a User consents to the installation of cookies if that User configured his/ her browser to refuse cookies.

If a computer program is intended to perform certain functions that are contrary to the reasonable expectations of a user, additional prescribed information must also be clearly and prominently described and brought to the attention of the User. Some of these functions include: collecting personal information stored on a computer system, interfering with the User's control of the computer system, and changing or interfering with settings, preferences or commands on the computer system without the knowledge of the User. In certain circumstances, CASL also requires the provision of assistance to Users in removing or disabling computer programs.

There is a limited transitional period for CASL's provisions relating to the installation of computer programs. If a computer program was installed before January 15, 2015, the User's consent to the installation of an update or upgrade to the program is implied until the earlier of January 15, 2018 and the date that the person withdraws their implied consent. The installation of computer programs after January 15, 2015 (as well as the installation of updates or upgrades to such programs) will, however, have to comply with CASL.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.