Update on Canada s Anti-Spam Legislation (CASL) for Portfolio Management Association of Canada (PMAC)

Transcription

1 Update on Canada s Anti-Spam Legislation (CASL) for Portfolio Management Association of Canada (PMAC) Barry B. Sookman Direct Line: (416) bsookman@mccarthy.ca June 28, 2012

2 CASL purpose The purpose of CASL is to promote the efficiency and adaptability of the Canadian economy by regulating commercial conduct that discourages the use of electronic means to carry out commercial activities, because that conduct (a) impairs the availability, reliability, efficiency and optimal use of electronic means to carry out commercial activities; (b) imposes additional costs on businesses and consumers; (c) compromises privacy and the security of confidential information; and (d) undermines the confidence of Canadians in the use of electronic means of communication to carry out their commercial activities in Canada and abroad. (s. 3) 2

3 Scope of CASL Anti-SPAM Anti-spyware/malware Amendments to PIPEDA prohibiting address harvesting and personal information harvesting Amendments to the Competition Act prohibiting false or misleading representations in electronic messages, sender information in electronic messages, subject matter information in electronic messages, locaters 3

4 CASL history Received royal assent on December 15, Original draft regulations were published in the summer of 2011 by the CRTC and Industry Canada. The Canadian business community raised serious objections to their strict requirements. The CRTC enacted revised regulations, which were finalized on March 28, The new regulations eased up on some of the more onerous requirements. Revised draft regulations from Industry Canada are expected shortly. They are also expected to ease up on certain requirements and may contain new exceptions. Expected to be in force in

5 Do PMAC members need to be concerned about the antispam provisions in CASL? 5

6 Comments on CASL Canadian Chamber of Commerce: the overly broad language in both the Act and the proposed regulations could circumscribe legitimate business-to-business activities and inadvertently impact businesses ability to deliver products and services to consumers. The Act and proposed Regulations do not adequately balance the objective of preventing unwanted, or harmful behaviour with the objectives of ensuring that perfectly legitimate acts are not made illegal, and preserving the vitality of the Internet for electronic commerce. Furthermore, they introduce conflicting or unnecessary regulatory regimes that needlessly impose significant costs on legitimate business. (emphasis added) 6

7 Comments on CASL Canadian Bankers Association we remain concerned with the broad range of the Anti-spam Act and the strict nature of its language... In our view, the Anti-spam Act contains provisions that are unnecessary to achieve the stated objective of dealing with malicious spam, including some provisions that will have a severe negative impact upon legitimate electronic commerce unless regulations are enacted to exclude from the scope of the Act legitimate electronic communications... Applying electronic marketing processes to a completely new and extremely broad range of electronic messages will be timeconsuming and expensive for all Canadian businesses. (emphasis added) 7

8 Comments on CASL Investment Industry Association of Canada We are concerned that the provisions designed to curtail certain electronic commercial communications are drafted so broadly so as to discourage, and even preclude the growth of legitimate and desirable online commercial activities. Such activities are necessary for the efficient functioning of many professional and commercial enterprises not in the business of electronic marketing per se. 8

9 Approach of SPAM provisions The anti-spam provisions depart significantly from other international anti-spam legislation which: applies to s that are sent in violation of an individual s opt-out request, or are fraudulent, false or misleading (US CAN SPAM); applies to for the purposes of direct marketing to individuals (EU Directive, UK Act); applies to a defined list of commercial electronic messages that relate to direct marketing (Australia Spam Act; NZ Spam Act); and applies to a defined list of commercial electronic messages that relate to direct marketing that are sent in bulk (Singapore Spam Act). The anti-spam provisions do not target only unsolicited CEMs for the purpose of solicitation as do the telemarketing rules under the National Do Not Call List (CRTC Telecom Decision ) 9

10 Certain International Comparisons Country Applies To Notes Canada (CASL C-28) U.S. (CAN-SPAM Act of 2003) Australia (Spam Act 2003) New Zealand (Unsolicited Electronic Messages Act 2007) Singapore (Spam Control Act 2007) Hong Kong (Unsolicited Commercial Messages Ordinance) any electronic message that, having regard to the content of the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity any electronic message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service a commercial electronic message is an electronic message, where it would be concluded that the purpose, or one of the purposes, of the message is [among an exclusive list of purposes related to advertising and offering goods and services] commercial electronic message means an electronic message that markets or promotes [goods or services], or assists or enables a person to obtain dishonestly a financial advantage or gain from another person a commercial electronic message is an electronic message, where it would be concluded that the primary purpose of the message is [among an exclusive list of purposes related to advertising and offering goods and services] commercial electronic message means an electronic message the purpose, or one of the purposes, of which is [among an exclusive list of purposes related to advertising and offering goods and services] Consent to receive the message can only be implied where there is an existing relationship (within the last 2 years) Prohibitions on unsolicited messages are limited to messages that are fraudulent or misleading (s.4), those that do not contain prescribed information (s.5) or those sent in violation of an opt out request. Consent can be inferred from the conduct, business and relationships of the persons concerned. Consent can be inferred from the conduct, business and relationships of the persons concerned. Prohibitions on unsolicited messages are limited to messages that are sent in bulk (s.6 & 11) Prohibitions on unsolicited messages are limited to those that are sent using automated means (s.18 & 19) or with the intent to deceive or mislead (s.20) 10

11 Very high liability Administrative monetary penalties (AMPS) with caps up to $1 million for an individual and $10 million for anyone else. (s.20(4)) Private rights of action by anyone affected by a prohibited act (s.47(1)) with liability that consists of: compensation for loss, damages and expenses; and extensive awards that are capped at: $1 million per day for breach of SPAM, malware, spyware, message routing, address and personal information harvesting, and Competition Act provisions; $1 million for each act of aiding, inducing, or procuring a breach of the SPAM, malware and spyware, and message routing provisions, plus liability up to $1 million per day for breach of SPAM, malware, spyware, and message routing provisions. Risk of class actions. 11

12 Extensive accessorial and vicarious liability Liability extends to any person who aids, induces or procures a prohibited act. (s.9) Businesses are liable for acts of their employees within the scope of their authority. (s.32, s.53) Liability extends to officers, directors, agents, mandataries if they directed, authorized, assented to, acquiesced, or participated in the prohibited act. (s.31, s.52) 12

13 Territorial reach The anti-spam provisions apply to any message where a computer system located in Canada is used to send or access the electronic message. (s.12(1)) ITAC: CASL will impact a range of business decisions that could have unintended negative effects on the competitiveness of a wide range of Canadian technology companies... First, Canadian multi-national companies sending messages to non-canadian customers are incented to use vendors located outside Canada to send those messages... Second, foreign companies deciding where to locate...facilities related to cloud computing... may choose against Canada because of the extra cost of complying with CASL... Third, Canadian providers of outsourced services to non-canadian businesses will be at a major disadvantage compared to competitors in other countries. 13

14 Analysis of the anti-spam provisions and regulations 14

15 The Anti-SPAM Prohibition S.6 (1) It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless: a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and b) the message complies with subsection (2). (2) The electronic messages must be in a form that conforms to the prescribed requirements and must: a) set out prescribed information that identifies the person who sent the message; b) set out information enabling the person to whom the message is sent to readily contact the sender; and c) set out the prescribed unsubscribe mechanism. 15

16 What messaging systems are covered electronic message means a message sent by any means of telecommunication, including a text, sound, voice or image message. (s1(1)) (But, excludes interactive two-way voice communication between individuals, fax messages to a telephone account, voice recordings to a telephone account. (s.6(8)) electronic address means an address used in connection with the transmission of an electronic message to (a) an electronic mail account; (b) an instant messaging account; (c) a telephone account; or (d) any similar account. (s.1(1)) 16

17 What messaging systems are covered Covers opt-in closed messaging systems e.g., social networks, instant messaging, online portals, SMS, electronic alerts, and other messaging systems and methods. TELUS: Application of CASL... [where Canadians are already protected by other regimes, such as through contractual arrangements] would add an unnecessary and inefficient layer of regulation that would have little to no effect on actual SPAM or malware, and, to the contrary, could actually reduce the utility (and/or increase the cost) of electronic messaging and software installation for legitimate purposes. 17

18 What is a CEM? A commercial electronic message is an electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that (a) offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land; (b) offers to provide a business, investment or gaming opportunity; (c) advertises or promotes anything referred to in paragraph (a) or (b); or (d) promotes a person, including the public image of a person, as being a person who does anything referred to in any of paragraphs (a) to (c), or who intends to do so. (s.1(2)) 18

19 Problems with scope of CEMs Some messages that might not be CEMs are treated as CEMs to which the form and unsubscribe provisions apply. The consent requirement does not apply to a CEM that solely (s.6(6)): provides a quote or estimate... if the quote or estimate was requested; facilitates, completes or confirms a commercial transaction that the person to whom the message is sent previously agreed to enter into with the person who sent the message; provides warranty information, product recall information or safety or security information about a product, goods or a service that the person to whom the message is sent uses, has used or has purchased; provides notification of factual information about (i) the ongoing use or ongoing purchase by the person to whom the message is sent of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship by the person who sent the message, or (ii) the ongoing subscription, membership, account, loan or similar relationship of the person to whom the message is sent; provides information directly related to an employment relationship or related benefit plan; delivers a product, goods or a service, including product updates or upgrades, that the person to whom the message is sent is entitled to receive under the terms of a transaction... 19

20 Problems with scope of CEMs Canadian Marketing Association: A fundamental issue with CASL is that of its scope. The definition of commercial electronic message (CEM) is sufficiently wide that it is conceivable to argue that any and all electronic communication is commercial in nature. This thereby imposes strict, and costly if not followed correctly, rules on the delivery of all electronic messages. CASL further confuses the issue by clearly defining CEM In Section 1(2), exempting certain messaging from consent requirements In Section 6(6), but still requiring that they meet the unsubscribe requirements laid out in Section 11(1). 20

21 General exception to CASL An inquiry or application related to a person engaged in a commercial activity. (s.6(5)) Personal or family relationships (s.6(5)(a)) Telecommunication Service Providers (TSP) A class, or sent in circumstances, defined in regulations. (s.6(5)). Additional exceptions and classes of implied consents could be included in forthcoming Industry Canada regulations. 21

22 General exception for family relationships Draft Industry Canada reg s.2. For the purposes of paragraph 6(5)(a) of the Act (a) family relationship means the relationship between individuals who are connected by (i) a blood relationship, if one individual is the child or other descendant of the other individual, the parent or grandparent of the other individual, the brother or sister of the other individual or of collateral descent from the other individual s grandparent, (ii) marriage, if one individual is married to the other individual or to an individual connected by a blood relationship to that other individual, (iii) a common-law partnership, if one individual is in a common-law partnership with the other individual or with an individual who is connected by a blood relationship to that other individual; and (iv) adoption, if one individual has been adopted, either legally or in fact, as the child of the other individual or as the child of an individual who is connected by a blood relationship to that other individual. 22

23 General exception for personal relationships Draft Industry Canada reg s.2. For the purposes of paragraph 6(5)(a) of the Act (b) personal relationship means the relationship, other than in relation to a commercial activity, between an individual who sends the message and the individual to whom the message is sent, if they have had an in-person meeting and, within the previous two years, a two-way communication. Are these exceptions appropriate for 21 st century relationships? This definition may be amended in the revised regulations. 23

24 General exception for TSPs To a telecommunications service provider (TSP) merely because a service provider provides a telecommunications service that enables the transmission of the message. (s.6(7)). Telecommunications service and TSP are broadly defined (s.1(1)): telecommunications service means a service, or a feature of a service, that is provided by means of telecommunications facilities, whether the telecommunications service provider owns, leases or has any other interest in or right respecting the telecommunications facilities and any related equipment used to provide the service. telecommunications service provider means a person who, independently or as part of a group or association, provides telecommunications services. 24

25 Implied consents to send CEMs Implied Consents Consents to collect, use or disclose information under PIPEDA or provincial privacy laws are not necessary valid for the purposes of CASL. CASL will create a conflicting consent regime with the consent regime in PIPEDA and provincial privacy laws since implied consents are a list of closed categories. Problems: businesses cannot rely on PIPEDA or provincial privacy laws consents to use personal information since the regimes are different e.g., disclosure standards, standards for determining implied consents, and exceptions are not the same. consents cannot be inferred by conduct as in Australia PIPEDA consents are not grandfathered. 25

26 PIPEDA consents are not implied consents CMA As a result of potential contradictions with existing privacy law, the new regime may disqualify entire databases of personal contact data obtained using responsible consent processes which meet, and in some cases exceed, the requirements of the Personal Information and Protection of Electronic Documents Act (PIPEDA). The failure to grandfather existing databases that meet the requirements of PIPEDA will not reduce the amount of SPAM messages Canadians receive, but will in turn create a massive financial burden on Canadian organizations. (emphasis added) McCarthy Tétrault LLP / mccarthy.ca 26

27 Implied consents are not inferred consents ESAC: The exception for implied consent in the Act is quite narrow and specific, and in light of the diversity and rapidly changing nature of business communications there is a very significant risk that a CEM could violate the provision and subject the sender to considerable liability even if consent could reasonably be inferred from the circumstances simply because it did not happen to fall within the narrow definition of "existing business relationship". McCarthy Tétrault LLP / mccarthy.ca 27

28 Implied consents to send CEMs A consent is implied for the purpose of the anti-spam provisions if: there is an existing business relationship or an existing non-business relationship, as those terms are defined. (s.10(9)) Existing business relationship is a business relationship arising from (s.10(10)): a) the purchase or lease of a product, goods, a service, land or an interest or right in land, within the 2-year period immediately before the day on which the message was sent; b) the acceptance by the recipient, within the period referred to in paragraph (a), of a business, investment or gaming opportunity; c) the bartering of anything mentioned in paragraph (a)... d) a written contract entered into between the recipient and the sender in respect of a matter not referred to in any of paragraphs (a) to (c), if the contract is currently in existence or expired within the period referred to in paragraph (a); or e) an inquiry or application, within the 6-month period immediately before the day on which the message was sent, made by the recipient to the sender, in respect of anything mentioned in any of paragraphs (a) to (c). 28

29 Implied consents to send CEMs (a) the purchase or lease of a product, goods, a service, land or an interest or right in land, within the 2-year period immediately before the day on which the message was sent; Problem: Most investment firms don t have existing databases which can be readily used to determine whether there has been a purchase within the two year period. A significant effort would be entailed to determine whether any given customer falls within the two year window. The existing business relationship is entity specific the relationship must be between the entity sending the CEM and the recipient. A new database would have to be created to determine which customers have an EBR. 29

30 Implied consents to send CEMs s.10(14) Where a period is specified in subsection (10) in relation to the purchase or lease of a product, goods, a service, (a) in the case of a purchase or lease, if it involves an ongoing use or ongoing purchase under a subscription, account, loan or similar relationship, the period is considered to begin on the day that the subscription, account, loan or other relationship terminates. (emphasis added) Problems: Some relationships will not be in respect of a purchase of a service under an account, loan, or similar relationship ; e.g., would purchase of investment products such as mutual funds, pure services such as advice be covered? Some relationships may not involve ongoing use or purchases e.g. a customer that buys a familiar instruments, gets retirement advice; a mutual fund purchase, but is there an ongoing use or purchase? When is there is ongoing use of an account; when does an inactive account go dormant; when does the relationship terminate? It doesn t solve the problem that EBR exception is entity specific. 30

31 Implied consents to send CEMs (d) a written contract entered into between the recipient and the sender in respect of a matter not referred to in any of paragraphs (a) to (c), if the contract is currently in existence or expired within the period referred to in paragraph (a); Problem: Requires that a written contract be entered into by the customer what qualifies? It doesn t solve the problem that EBR exception is entity specific e.g. must be both a contract and a business relationship with the entity The bank would have to analyze all contracts and determine which ones are not matters covered by paras (a) to (c) e.g. which contracts don t relate to an account, loan, or similar relationship. 31

32 Other Implied consents to send CEMs The only other implies circumstances are where: the person to whom the message is sent has conspicuously published the electronic address without a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address AND the message is relevant to the person s business, role, functions or duties in a business or official capacity; the person to whom the message is sent has disclosed, to the person who sends the message, the electronic address without indicating a wish not to receive unsolicited commercial electronic messages, AND the message is relevant to the person s business, role, functions or duties in a business or official capacity; or the message is sent in the circumstances set out in the regulations. The revised regulations may contain new categories of implied consent. McCarthy Tétrault LLP / mccarthy.ca 32

33 Whose consent is needed? A reference to the person to whom an electronic message is sent means the holder of the account associated with the electronic address to which the message is sent, as well as any person who it is reasonable to believe is or might be authorized by the account holder to use the electronic address. (s.1(5)) Whose consent is needed in business to business relationships e.g., who has the existing business relationship with the sender? Whose consent is needed when a business sends CEMs to clients at their employment account? Who has conspicuously published an electronic address? McCarthy Tétrault LLP / mccarthy.ca 33

34 Implied consents to send CEMs Existing non-business relationship is a non-business relationship arising from (s.10(13)): a) a donation or gift made by recipient to the sender within the 2-year period immediately before the day on which the message was sent, where the sender is a registered charity, a political party or organization, or a person who is a candidate for publicly elected office; b) volunteer work performed by the recipient for the sender, or attendance at a meeting organized by the sender, within the 2-year period immediately before the day on which the message was sent, where the sender is a registered charity, a political party or organization, or a person who is a candidate for publicly elected office; or c) membership, as defined in the regulations, by the recipient, in the sender, within the 2-year period immediately before the day on which the message was sent, where the sender is a club, association or voluntary organization, as defined in the regulations. 34

35 Implied consents to send CEMs Draft Industry Canada reg. 4.(1) For the purposes of paragraph 10(13)(c) of the Act, membership is the status of having been accepted as a member of a club, association or voluntary organization in accordance with the membership requirements of the club, association or organization. (2) For the purposes of paragraph 10(13)(c) of the Act, a club, association or voluntary organization is a non-profit organization that is organized and operated exclusively for social welfare, civic improvement, pleasure or recreation or for any purpose other than profit, if no part of its income is payable to, or otherwise available for the personal benefit of any proprietor, member or shareholder of that organization unless the proprietor, member or shareholder is an organization the primary purpose of which is the promotion of amateur athletics in Canada. 35

36 Getting express consents to send CEMs Express consents A person who seeks express consent must, when requesting consent, set out clearly and simply the following information: (a) the purpose or purposes for which the consent is being sought; (b) prescribed information that identifies the person seeking consent and, if the person is seeking consent on behalf of another person, prescribed information that identifies that other person; and (c) any other prescribed information. (s.10(1)). See also (s.6(2)). 36

37 Getting express consents to send CEMS CRTC reg s.4. For the purposes of subsections 10(1) and (3) of the Act, a request for consent may be obtained orally or in writing and must be sought separately for each act described in sections 6 to 8 of the Act and must include (a) the name by which the person seeking consent carries on business, if different from their name, if not, the name of the person seeking consent; (b) if the consent is sought on behalf of another person, the name by which the person on whose behalf consent is sought carries on business, if different from their name, if not, the name of the person on whose behalf consent is sought; (c) if consent is sought on behalf of another person, a statement indicating which person is seeking consent and which person on whose behalf consent is sought; and (d) the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and (e) a statement indicating that the person whose consent is sought can withdraw their consent. Problems: single request does not cover all activities; requires disclosure of information about each affiliate. 37

38 Conditions for getting consents Despite paragraph 10(1)(b), for the purposes of section 6, if a person is seeking express consent on behalf of a person whose identity is not known, (a) the only information that is required to be provided under that paragraph is prescribed information that identifies the person seeking consent; and (b) the person seeking consent must comply with the regulations in respect of the use that may be made of the consent and the conditions on which the consent may be used. (s. 10(2)) Draft: Industry Canada reg. 3(1) For the purposes of paragraph 10(2)(b) of the Act, a person who obtained express consent on behalf of a person whose identity was unknown may authorize any person to use the consent on the condition that the person who obtained consent ensures that, in any commercial electronic message sent to the person from whom consent was obtained, (a) the person who obtained consent is identified; and (b) the authorized person provides an unsubscribe mechanism that, in addition to meeting the requirements set out in section 11 of the Act, allows the person from whom consent was obtained to withdraw their consent from the person who obtained consent or any other person who is authorized to use the consent. 38

39 Conditions for getting consents Draft Industry Canada reg. 3(2) The person who obtained consent must ensure that, on receipt of an indication of withdrawal of consent by the authorized person who sent the commercial electronic message, that authorized person notifies the person who obtained consent that consent has been withdrawn from, as the case may be, (a) the person who obtained consent; (b) the authorized person who sent the commercial electronic message; or (c) any other person who is authorized to use the consent. (3) The person who obtained consent must inform, without delay, a person referred to in paragraph 2(c) of the withdrawal of consent on receipt of notification of withdrawal of consent from that person. (4) The person who obtained consent must give effect to a withdrawal of consent and, if applicable, ensure that a person referred to in paragraph 2(c) gives effect to the withdrawal of consent, in accordance with subsection 11(3) of the Act. 39

40 Information to be included in CEMs The electronic messages must be in a form that conforms to the prescribed requirements and must: (a) set out prescribed information that identifies the person who sent the message; and (b) set out information enabling the person to whom the message is sent to readily contact the sender (the contact information must be valid for 60 days). S. 2(1) CRTC reg: For the purposes of subsection 6(2) of the Act, the following information must be set out in any commercial electronic message: (a) the name by which the person sending the message carries on business, if different from their name, if not, the name of the person; (b) if the message is sent on behalf of another person, the name by which the person on whose behalf the message is sent carries on business, if different from their name, if not, the name of the person on whose behalf the message is sent; (c) if the message is sent on behalf of another person, a statement indicating which person is sending the message and which person on whose behalf the message is sent; and (d) the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an address or a web address of the person sending the message or, if different, the person on whose behalf the message is sent. Problems: Requires disclosure of information about each affiliate. Significant information in each CEM for some message formats. 40

41 Unsubscribe requirements The electronic messages must: (c) set out the prescribed unsubscribe mechanism. (s.6(2) & (3)). The unsubscribe mechanism must (a) enable the recipient to indicate, at no cost to them, the wish to no longer receive any commercial electronic messages, or any specified class of such messages, from the sender, using (i) the same electronic means by which the message was sent, or (ii) if using those means is not practicable, any other electronic means that will enable the person to indicate the wish; and (b) specify an electronic address, or link to a page on the World Wide Web that can be accessed through a web browser, to which the indication may be sent (the address or Web page must be valid for 60 days). (s.11(1) & (2)) CRTC reg s.3(2) The unsubscribe mechanism referred to in paragraph 6(2)(c) of the Act must be able to be readily performed. (emphasis added) Problems: How can most CEMs accommodate opt-out from any specified class of messages? What is meant by readily performed for the unsubscribe mechanism requirement? Cannot confirm unsubscribe requests before giving effect to them. 41

42 Methods of displaying information and unsubscribe mechanism in CEMs CRTC reg s.3(1) The information referred to in section 2 and the unsubscribe mechanism referred to in paragraph 6(2)(c) of the Act must be set out clearly and prominently. CRTC reg s.2(2) If it is not practicable to include the information referred to in subsection (1) and the unsubscribe mechanism referred to in paragraph 6(2)(c) of the Act in a commercial electronic message, that information may be provided by a link to a web page on the World Wide Web that is readily accessible by the person to whom the message is sent at no cost to them by means of a link that is clearly and prominently set out in the message. (emphasis added) Problems: When is it not practical to include the information in the CEM? How prominent does the disclosure and unsubscribe mechanism have to be? How readily accessible must the link be? Is it possible to comply with the disclosure and unsubscribe requirements for short message types e.g. IM, SMS? 42

43 Problems meeting unsubscribe requirements Such an indication must be given effect without delay, and in any event no later than 10 business days after the indication has been sent, without any further action being required on the part of the person who so indicated. (s. 11(3)) 43

44 Transitional Provisions 44

45 Transitional provisions Commercial electronic messages: A person s consent to receiving commercial electronic messages from another person is implied until the person gives notification that they no longer consent to receiving such messages from that other person or until 3 years after the day on which section 6 comes into force, whichever is earlier, if, when that section comes into force, (a) those persons have an existing business relationship or an existing non-business relationship, as defined in subsection 10(10) or (13), respectively, without regard to the period mentioned in that subsection; and (b) the relationship includes the communication between them of commercial electronic messages. (s. 66) Problems: Companies must establish an EBR. See problems above. 45

46 Analysis of the antispyware/malware provisions and proposed regulations McCarthy Tétrault LLP / mccarthy.ca 46

47 The prohibition 8. (1) A person must not, in the course of a commercial activity, install or cause to be installed a computer program on any other person s computer system or, having so installed or caused to be installed a computer program, cause an electronic message to be sent from that computer system, unless: (a) (b) the person has obtained the express consent of the owner or an authorized user of the computer system and complies with [the disclosure requirements of] subsection 11(5); or the person is acting in accordance with a court order. Problems: Implied consents cannot be relied upon. Only express consents are valid, assuming compliance with the disclosure requirements. Written agreements or click-wraps will comply. Web wrap agreements will likely not comply. 47

48 Scope of prohibition Applies to computer programs (defined in subsection 342.1(2) of the Criminal Code) as meaning data representing instructions or statements that, when executed in a computer system, causes the computer system to perform a function. Includes apps and updates. Note: Computer programs are not limited to malware or spyware. Installed on another person s computer system (defined in subsection 342.1(2) of the Criminal Code) as meaning a device that, or a group of interconnected or related devices one or more of which, (a) contains computer programs or other data, and (b) pursuant to computer programs, (i) performs logic and control, and (ii) may perform any other function. Note: Computer systems could include: servers, PCs, smartphones, tablets, ebook readers, the Cloud, websites and web services, industrial machines, appliances, autos, and other consumer products. 48

49 Disclosure requirements to comply with malware and spyware provisions Two levels of disclosure required when obtaining consent. 1. Minimum Disclosure: A person who seeks express consent, must when requesting consent, also, in addition to setting out any other prescribed information, must clearly and simply describe, in general terms the function and purpose of the computer program that is to be installed if the consent is given. (s.10(3)) 49

50 Disclosure requirements to comply with malware and spyware provisions 2. Enhanced Disclosure: If the computer program meets one of the specified malware or spyware criteria in s.10(5), the person who seeks express consent must, when requesting consent, clearly and prominently, and separately and apart from the licence agreement, (a) describe the program s material elements that perform the function or functions, including the nature and purpose of those elements and their reasonably foreseeable impact on the operation of the computer system; and (b) bring those elements to the attention of the person from whom consent is being sought in the prescribed manner. 50

51 Disclosure requirements to comply with malware and spyware provisions Enhanced Disclosure: The enhanced disclosure standard applies where the program performs functions that the person knows and intends will cause the computer system to operate in a manner that is contrary to the reasonable expectations of the owner or authorized user of the computer collects personal information; interferes with control of the computer; changes or interferes with settings preferences or commands; obstructs, interrupts, or interferes with access to data; causes the computer to communicate with another computer without authorization,: installing a computer program that can be activated by a third party: installing a bot, or something set out in the regulations; but not merely transmission data. (s.10(5) &(6)). 51

52 Enhanced disclosure in regulations CRTC Regulations, s.5 (unchanged): 5. A computer program s material elements that perform one or more of the functions listed in subsection 10(5) of the Act must be brought to the attention of the person from whom consent is being sought separately from any other information provided in a request for consent and the person seeking consent must obtain an acknowledgement in writing from the person from whom consent is being sought that they understand and agree that the program performs the specified functions. 52

53 Enhanced disclosure in regulations Microsoft: Requiring users to click through multiple screens before using a product can tire them and make it more likely that they will simply click quickly through the screens without paying close attention. Microsoft suggests that the Commission revise section 5 of the regulations and delete the phrase separately from any other information provided in a request for consent and replace it with clearly and prominently and in a manner that an ordinary user would likely understand and separately and apart from the licence agreement. 53

54 Enhanced disclosure in regulations ESAC: Moreover, the requirement that the consent be obtained, in writing, and include a specific acknowledgement from the user that they understand and agree that the computer program will perform the specified functions is deeply problematic. The only way to obtain the acknowledgement of consent to a specific function will be to generate an electronic message to be sent to the company. However, this would constitute installing a computer program that causes an electronic message to be sent, which is also prohibited and for which a separate consent will be required. This will multiply the number of consents that must be obtained, which will be extremely onerous for business and overwhelming to the consumer. Further, in the event that a consumer declines to consent to the transmission of the acknowledgement, the company will be unable to comply with the requirement and thus be penalized for not obtaining the required acknowledgement in writing, when the reason for doing so was outside their control. 54

55 Enhanced disclosure in regulations ITAC: Legitimate circumstances exist where a wireless carrier, device vendor or software publisher might want to push programs to end-user devices to control theft and fraud. These are circumstances in which the operation needs to be done without whoever possesses the device at the time knowing it. 55

56 Exceptions for Software Updates, Upgrades and Patches The formalities for obtaining express consent (ss10(1) and (3)) are not required for the installation of an update or upgrade so long as the installation or use of the computer program being updated was expressly consented to and the person who gave the consent is entitled to, and does receive the update under the terms of the express consent. (s.10(7)) Problem: There is no express exception that permits installation of an update or upgrade without consent. The original consent to install a program must include a consent to install updates or upgrades or they cannot be installed without requesting and obtaining a new consent. 56

57 Getting express consents to comply with malware and spyware provisions Obtaining consent: A person who seeks express consent must, when requesting consent, set out clearly and simply the following information: (a) the purpose or purposes for which the consent is being sought; (b) prescribed information that identifies the person seeking consent and, if the person is seeking consent on behalf of another person, prescribed information that identifies that other person; and (c) any other prescribed information. (s.10(1)). 57

58 Getting express consents to send CEMS CRTC reg s.4. For the purposes of subsections 10(1) and (3) of the Act, a request for consent may be obtained orally or in writing and must be sought separately for each act described in sections 6 to 8 of the Act and must include (a) the name by which the person seeking consent carries on business, if different from their name, if not, the name of the person seeking consent; (b) if the consent is sought on behalf of another person, the name by which the person on whose behalf consent is sought carries on business, if different from their name, if not, the name of the person on whose behalf consent is sought; (c) if consent is sought on behalf of another person, a statement indicating which person is seeking consent and which person on whose behalf consent is sought; and (d) the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and (e) a statement indicating that the person whose consent is sought can withdraw their consent. Problems: Each consent must be separate; how can consent be withdrawn for a program that is already installed? 58

59 Withdrawal of consent for spyware functionality Withdrawal of consent: If the computer program installed meets one of the specified malware or spyware criteria in s.10(5), the person who installs the program with consent must for 1 year provide an electronic address to which a request can be sent to remove or disable the computer program if the requestor believes that the function, purpose or impact of the computer program installed under the consent was not accurately described when consent was requested; and if the consent was based on an inaccurate description of the material elements of the enumerated function or functions, must, without cost to the person who gave consent, assist that person in removing or disabling the computer program as soon as feasible. (s.11(5)) 59

60 Unsubscribe from computer programs? RIM: Subsection 4(e) also appears to permit a person to withdraw his or her consent for the acts specified in section 7 or section 8 of CASL. However, CASL does not permit a person to withdraw his or her consent under these sections e.g. a person cannot withdraw consent to the installation of a computer program or updates. The Commission has no power, indirectly through the regulations, to establish a regime to permit consents to be withdrawn where clearly not called for or contemplated in CASL. 60

61 Exclusions from the consent and disclosure requirements A person is considered to expressly consent to the installation of a computer program if: a) the program is: i. a cookie, ii. iii. iv. HTML code, Java Scripts, an operating system, v. any other program that is executable only through the use of another computer program whose installation or use the person has previously expressly consented to, or vi. any other program specified in the regulations; and b) the person s conduct is such that it is reasonable to believe that they consent to the program s installation. (s.10(8)) Note, there is no express waiver of the disclosure requirement, but disclosure is only required where express requests are being sought. 61

62 Amendments to Competition Act

63 Richard v. Time Inc., 2012 SCC 8 CASL amends Competition Act new (s and s ) prohibits representation that is false or misleading in a material respect in electronic message prohibits false or misleading representation in (i) sender information in electronic message; (ii) subject matter information in electronic message; and (iii) locater it is our opinion that the test under s. 218 C.P.A. is that of the first impression. In the case of false or misleading advertising, the general impression is the one a person has after an initial contact with the entire advertisement, and it relates to both the layout of the advertisement and the meaning of the words used. This test is similar to the one that must be applied under the Trade-marks Act. A court asked to assess the veracity of a commercial representation must therefore engage...in a two-step analysis that involves having regard...to the literal meaning of the words used by the merchant (1) describing the general impression that the representation is likely to convey to a credulous and inexperienced consumer; and (2) determining whether that general impression is true to reality. If the answer at the second step is no, the merchant has engaged in a prohibited practice. 63

64 VANCOUVER Suite 1300, 777 Dunsmuir Street P.O. Box 10424, Pacific Centre Vancouver BC V7Y 1K2 Tel: Fax: Toll-Free: CALGARY Suite 3300, 421 7th Avenue SW Calgary AB T2P 4K9 Tel: Fax: Toll-Free: TORONTO Box 48, Suite 5300 Toronto Dominion Bank Tower Toronto ON M5K 1E6 Tel: Fax: Toll-Free: MONTRÉAL Suite De La Gauchetière Street West Montréal QC H3B 0A2 Tel: Fax: Toll-Free: QUÉBEC Le Complexe St-Amable 1150, rue de Claire-Fontaine, 7e étage Québec QC G1R 5G4 Tel: Fax: Toll-Free: UNITED KINGDOM & EUROPE 125 Old Broad Street, 26th Floor London EC2N 1AR UNITED KINGDOM Tel: +44 (0) Fax: +44 (0)