Canada's New Anti-spam Law Are you prepared? Tricia Kuhl (Blakes) Dara Lambie (Blakes) Presented to ACC Ontario Chapter May 9, 2012

Transcription

1 Canada's New Anti-spam Law Are you prepared? Tricia Kuhl (Blakes) Dara Lambie (Blakes) Presented to ACC Ontario Chapter May 9, 2012

2 OVERVIEW Background & Status Breadth & Scope Penalties & Liability Compliance Strategies 2

3 BACKGROUND & STATUS 2004: Task Force on SPAM launched 2005: Task Force Report published 2009: Bill C-27 Electronic Commerce Protection Act (ECPA) 2010: Bill C-28 Fighting Internet and Wireless Spam Act (FISA) introduced in May Canada s Anti-Spam Legislation (CASL) obtained Royal Assent in December 2011: Draft CRTC regulations published in June Draft Industry Canada (IC) regulations published in July Consultation process throughout the Fall 2012: Final CRTC regulations (Electronic Commerce Protection Regulations) published March 28 Revised IC regulations expected in late Spring* 2013: Expected coming into force 3

4 KEY PROHIBITIONS 1. Sending unsolicited commercial e-messages ( CEMs ) to an e-address (SPAM) 2. Altering transmission data without express consent 3. Installing computer programs without express consent 4. Making false and misleading representations in e- messages 5. Collecting e-addresses using computer programs without consent 6. Collecting personal information through unauthorized access to a computer system 4

5 ANTI-SPAM It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied (not inferred); and b) the message complies with the formality requirements prescribed in the regulations 5

6 COMMERCIAL ELECTRONIC MESSAGE Means: a message sent by any means of telecommunication (e.g. text, sound, voice or image) that has as its purpose, or one of its purposes, to encourage the participation in a commercial activity ð a transaction, act or conduct of a commercial character, whether or not in the expectation of profit an e-message that requests consent to send a CEM is a CEM 6

7 ELECTRONIC ADDRESS Means: an address used in connection with the transmission of an electronic message to: an an instant messaging account a telephone account any similar account 7

8 GENERAL EXEMPTIONS CEMs that are exempt from the General Requirements of Consent, Form & Content: a CEM sent by an individual to another individual with whom they have a personal or family relationship a CEM sent to a person engaged in a commercial activity for the sole purpose of an inquiry or an application related to that activity a CEM that is of a class or is sent in circumstances specified in the IC regulations Various industry associations seeking more classes of exemptions 8

9 GENERAL EXEMPTIONS (cont.) Until certain dormant provisions take effect, also exempt are: CEMs that consist of: a voice recording sent to a telephone account an interactive two-way voice communication between individuals faxes sent to a telephone account (as they are subject to the National Do Not Call List) 9

10 EXEMPTIONS FROM CONSENT REQUIREMENTS ( Transactional Messages ) CEMs that comply with the Form and Content Requirements may be sent without prior consent if they solely: provide a requested quote or estimate facilitate or confirm a previously agreed upon commercial transaction provide warranty / safety information provide factual information about an ongoing subscription/ membership provide information regarding an employment relationship deliver a product, good or service under a prior transaction communicate for a purpose specified in the IC regulations 10

11 EXPRESS CONSENT REQUIREMENTS Express Consent - requires active opt in - when seeking express consent, sender must set out clearly and simply: a) purpose(s) for which consent is being sought; b) information that identifies the person, or person on whose behalf, consent is being sought; and c) any other information prescribed in the CRTC regulations (see next slide) 11

12 EXPRESS CONSENT REQUIREMENTS (cont.) Based on the final CRTC regulations, a Request for Consent may be obtained orally or in writing and must also include: - the name by which the person seeking consent and the person, if relevant, on whose behalf consent is sought carry on business (if different from their name) if not, their name(s) - a statement indicating which person is seeking consent and which person is the person on whose behalf consent is being sought (where relevant) - the mailing address, and either a telephone number (providing access to an agent or voice mail), address or web address of the person seeking consent, and, if different, the person on whose behalf the consent is sought - a statement that the person whose consent is sought can withdraw their consent 12

13 IMPLIED CONSENT REQUIREMENTS Implied Consent May be deemed only in the following cases: i. Existing business relationships ii. Existing non-business relationships iii. Conspicuous publication (where CEM relates to business or official capacity) iv. Voluntary disclosure (where CEM relates to business or official capacity) v. Circumstances set out in the IC regulations 13

14 IMPLIED CONSENT REQUIREMENTS (cont.) i. Existing business relationship deemed when: within 2 years preceding the day on which the message was sent: the recipient purchased, leased or bartered for a product, goods, a service, land or an interest or right in land the recipient accepted a business, investment, or gaming opportunity the recipient entered into a written contract that is in existence or expired within those 2 years within 6 months preceding the day on which the message was sent: the recipient made an inquiry or application 14

15 IMPLIED CONSENT REQUIREMENTS (cont.) ii. Existing non-business relationship deemed when: within 2 years preceding the day on which the message was sent: the sender is a registered charity, political party or organization, or a candidate for publicly elected office for whom the recipient made a donation performed volunteer work attended a meeting the recipient became a member of the sender s club, association or voluntary organization 15

16 FORM & CONTENT REQUIREMENTS Disclosure requirements Every CEM must: set out information prescribed in the CRTC regulations that identifies the person who sent message, or on whose behalf it is sent (see next slide) set out information enabling the recipient to contact the sender of the CEM contact information must be valid for a minimum of 60 days after message is sent an unsubscribe mechanism (described below) 16

17 FORM & CONTENT REQUIREMENTS (cont.) According to the final CRTC Regulations, every CEM must set out the following information: the business name of the sender (and the person on whose behalf the CEM is sent, where applicable) if different from their name, if not, the name of the person; if the message is sent on behalf of another person, a statement indicating which person is sending the message and which person on whose behalf the message is being sent; the mailing address, and either a telephone number (providing access to an agent or voice mail), address or web address of the person sending the message (or, if different, the name of the person on whose behalf it is sent) 17

18 FORM & CONTENT REQUIREMENTS (cont.) Unsubscribe mechanism Every CEM must allow for easy opt-out mechanism: - must enable recipient to indicate their wish to no longer receive CEMs (at no cost) - must be set out clearly and prominently and must be able to be readily performed (according to final CRTC regulations) - must set forth e-address or link to a web page to which indication to unsubscribe can be sent ð valid for a minimum of 60 days - effect must be given to unsubscribe request without delay ð but some flexibility for 10 days 18

19 FORM & CONTENT REQUIREMENTS (cont.) For certain types of CEMs, it may not be practicable to include all of the required information and the unsubscribe mechanism that is in the message itself In such cases, according to final CRTC regulations, senders may post such information on a web page that is readily accessible by the recipient, at no cost to them, by means of a link clearly and prominently set out in the message 19

20 ENFORCEMENT CRTC spam, spyware, altering transmission data Competition Bureau false or misleading statements in e-messages Privacy Commissioner collecting e-addresses or personal information Private Rights of Action all contraventions under CASL including class actions 20

21 LIABILITY Violations of CASL can create both direct and vicarious liability An officer, director or other mandatary of a corporation can be held liable for a violation if they directed, authorized, assented to, acquiesced in, or participated in the commission of the violation A person can be held liable for a violation by their employee/agent acting within the scope of their employment/authority Includes a Private Right of Action 21

22 PENALTIES Violation Sending unsolicited commercial e- messages to an e- address Altering transmission data without express consent Installing computer programs without express consent Penalty/Fine/Offence Maximum per breach: $1,000,000 for individuals $10,000,000 for corporations Private Right of Action $200 /day per breach, not exceeding $1,000,000 /day up to $1,000,000 /day up to $1,000,000 /day 22

23 PENALTIES (cont.) Violation Making false and misleading representations in e-messages Penalty/Fine/Offence Up to 1 year imprisonment and up to $200,000 in fines (on summary conviction) Up to 14 years imprisonment and a fine at the Court s discretion (on indictment) Private Right of Action $200 for each occurrence not to exceed $1,000,000 /day Collecting e-addresses using computer programs without consent Collecting personal information through unauthorized access to a computer system Maximum per breach: $1,000,000 for individuals $10,000,000 for corporations Maximum of $1,000,000 / day 23

24 CROSS-BORDER ISSUES CASL will have effects outside of Canada: The anti-spam provisions are applicable when a computer system in Canada is used to send or access the message The altering of transmission data provisions are applicable when a computer system in Canada is used to send, route or access the message This may cause cross-border issues, especially given that the Canadian law is stricter than legislation in other jurisdictions 24

25 CANADA S ANTI-SPAM LAW: TOUGHEST LAW IN THE WORLD? ANTI-SPAM LAW CAN-SPAM ACT SPAM ACT 2003 EU Directive 2002/58/ EC Messages covered all commercial e-messages only applies to (although new case law took expansive interpretation re: social media) all commercial e-messages most e-messages Consent Regime Scope Requires express opt-in consent (if exemptions do not apply) applies if any element of the message is commercial applies to messages sent from within or outside of Canada but accessed from within Canada opt-out opt-in mixed applies only where the primary purpose of an message is commercial applies if any element of the message is commercial applies to messages that have an Australian link applies to any message sent over a public communications network 25

26 TOUGHEST LAW IN THE WORLD? (cont.) ANTI-SPAM LAW CAN-SPAM ACT SPAM ACT 2003 EU Directive 2002/58/ EC When consent not required general exemptions (s. 6(5) & (6)) opt-out regime exemptions for designated commercial electronic messages not specified When consent implied exceptions (s. 10(9)) opt-out regime inferred consent exceptions similar to CASL existing business relationship Identification requirements sender person on whose behalf message sent contact info sender s postal address identify message as advertisement or solicitation person who authorized sending of message sender cannot disguise or conceal identity in message Unsubscribe requirements valid for 60 days after message sent sender must give effect immediately valid for 30 days sender can send messages up to 10 days after request valid for 30 days sender can send messages up to 5 days after request e-messages must contain valid address to which unsubscribe request can be made 26

27 COMPLIANCE STRATEGIES What should your business do now? 1. Create an Implementation Team Appoint a designated compliance officer and implementation team who will be responsible for compliance with CASL 2. Assess Current Practices Involving CEMs Conduct a compliance audit : ð Document all forms of electronic communications with former, current and prospective clients ð How does your organization collect electronic addresses? ( , Internet, social media, purchase (lists), telephone, in person, paper forms, mobile/text messaging ð How does your organization send CEMs? (mobile/text messaging, , social media, agent, telephone) ð Do any third parties provide CEM services to your organization? ð Pay attention to cross-border activity 27

28 COMPLIANCE STRATEGIES (cont.) 3. Categorize all e-communications: Create methods for tracking existing business relationships, non-business relationships as well as exempt electronic communications Establish systems for recording and documenting both express and implied consent Prepare guidelines on message formatting Prepare functional opt-out or unsubscribe mechanism 28

29 COMPLIANCE STRATEGIES (cont.) 4. Obtain Consent CASL not yet in force Get Consent Now! Maximize the benefits of transitional provisions Use implied consent to obtain express consent 5. Document Consent Obtained Maintain rolling lists/charts Remember: due diligence is a defence If in contravention: Sign an Undertaking 29