The Age of Consent: Canada s Opt-In Anti-Spam Law. International Legal Technology Association October 23, 2014 David Elder

Transcription

1 The Age of Consent: Canada s Opt-In Anti-Spam Law International Legal Technology Association October 23, 2014 David Elder MONTRÉAL TORONTO OTTAWA CALGARY VANCOUVER NEW YORK LONDON SYDNEY

2 Overview of Key Elements

3 in a Nutshell Commercial Electronic Messages Prohibits sending commercial electronic messages without express consent Some exceptions Installation of Computer Programs Prohibits the installation of a computer program without express consent Some exceptions Alteration/Rerouting Prohibits the alteration of transmission data or rerouting of messages without express consent 2

4 Application of Law CASL applies if a computer systems located in Canada is used to send or access an electronic message For messages sent from Canada, need not comply with CASL if comply with anti-spam law of destination country 3

5 Enforcement AMPs for violations (Up to $ 1 M individual, $ 10 M corporate) Undertakings Public shaming Registration with court enforced as contempt Injunctions, Restraining Orders Offences Private right of action Preservation demand Notice to produce Search warrant 4

6 CASL Timeline 5

7 Installation of Computer Programs SLIDE 6

8 Installation of Computer Program Must not install/cause to be installed a computer program on other s computer system Installed program must not cause electronic message to be sent from computer system Unless: Express consent of owner/authorized user Provide electronic address for remove/disable for 1 year Provide no-cost assistance re remove/disable request Acting pursuant to court order 7

9 8

10 Deemed Consent Cookies Html Code Java Scripts Operating System Executable only with program installed with consent Express Consent Must set out clearly: Purpose for consent Installer identification General Description of program function and purpose Enhanced Consent In addition to Express Consent: Separate from licence agreement Detailed description of material elements, including likely impact on user Greater prominence Explicit agreement form user to unexpected functions 9

11 10

12 Unsolicited Electronic Messages SLIDE 11

13 Core Anti-Spam Provision It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless: 1. One of the statutory exceptions applies, or 2. The sender has the express or implied consent of the recipient and the message is in the prescribed form 12

14 Q1: Is the message A COMMERCIAL ELECTRONIC MESSAGE?

15 Commercial Electronic Message An electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that a. offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land; b. offers to provide a business, investment or gaming opportunity; c. advertises or promotes anything referred to in paragraph (a) or (b); or d. promotes a person, including the public image of a person, as being a person who does anything referred to in any of paragraphs a) to (c), or who intends to do so. 14

16 Common electronic communications Type of Communication Market & Research Publications Invitations (seminars, social and sporting events, closing dinners, pitch meetings) Announcements purely factual (e.g. office closed due to flood ) Announcements promotional (e.g. new office opening, award received, new partner) Newsletters Blog Update Announcements CEM? Yes Yes No Yes Yes Yes

17 Common electronic communications Type of Communication Press Releases sent to media Press Releases sent to clients, prospects Forward Article of Interest Company publication or featuring Company or employee Forward Article of Interest third party publication, no mention of Company or employee Holiday e-cards Surveys CEM? Number of messages sent is irrelevant to whether a message is a CEM can be one or 10,000 No Yes Yes No No No*

18 Q2: Does the message fit within a STATUTORY EXEMPTION?

19 Exceptions from Consent and Form of Message Requirements PART 1 Sent by individual to individual with whom have a personal/family relationship personal relationship = direct, voluntary 2-way communications, reasonable to conclude personal, no indication don t want to receive CEMs family relationship = marriage, common-law, parent-child Only relevant to individuals, acting in their personal capacity Sent to business, message consists solely of a related inquiry/application or that business s response Internal CEMs concerning affairs of that organization 18

20 Forward-to-a-Friend CASL prohibits aiding, inducing or procuring a violation of the Act Care must be exercised in F2F campaigns to avoid possible liability: Include clear notice that messages to be forwarded only in compliance with law Ensure any incentives provided are modest Consider limiting the number of friends to which the message can be forwarded

21 B2B No Consent, No Form Requirements 1. Message sent to an employee, representative, consultant or franchisee of another organization Exemption applies between organizations 2. If the organizations have a relationship,* and Any two-way interactive activity; recipient must take some active step 3. The message concerns the activities of the organization to which the message is sent Must be broadly relevant to the organization s business activities, operations *You must be able to prove the existence of a qualifying relationship 20

22 Examples of Qualifying Relationships Existing or recent former client Requested publication, access to content Attended Company event (reception, seminar) Attended lunch with Company employee Meeting with Company employee 21

23 Exceptions from Consent and Form of Message Requirements PART 2 Sent to: Satisfy a legal or juridical obligation Provide notice of or enforce a right, court order, judgment or tariff Enforce a right arising under federal, provincial, municipal or foreign law Sent & received on electronic messaging services, with conspicuous unsubscribe, implicit or explicit consent to receive Sent on closed secure account by provider of account Will be accessed in foreign state, complies with local anti-spam law Sent by or on behalf of a registered charity, primary purpose is fundraising Sent by or on behalf of a political organization or candidate, primary purpose is fundraising Interactive voice, fax calls or voice recordings sent to telephone account as provided in regulations 22

24 Exceptions from Consent Requirement Only PART 1 Provides a quote or estimate, where requested by recipient Facilitates, completes or confirms a commercial transaction to which recipient previously agreed Provides warranty, recall, safety or security information about a product/good/service that recipient purchased Provides notification of factual info re ongoing subscription or membership Provides info to employee re employment, benefits Delivers a product, good or service entitled to receive 23

25 Exceptions from Consent Requirement Only PART 2 First CEM sent following a referral by an individual with: An existing business or non-business relationship (as defined) OR A personal or family relationship (as defined) with both sender and recipient AND where CEM discloses full name of referrer and states the message was sent as a result of the referral Note: this is a one-time exception 24

26 Q3: Does the sender have IMPLIED CONSENT?

27 4 Scenarios for Implied Consent 1 Existing Business Relationship 2 Existing Non-Business Relationship 3 Conspicuous Publication of Electronic Address 4 Disclosure of Electronic Address by Recipient 26

28 Implied consent 1. Existing business relationship: Purchase, sale or barter of goods/services within previous 2 years Acceptance of business opportunity within previous 2 years Written contract, in force, or expired within previous 2 years Inquiry or application re purchase, sale, barter or business opportunity within previous 6 months 2. Existing non-business relationship: Donation/gift to, or volunteer work for registered charity, political party or organization, candidate for public office within previous 2 years Membership in club, association or voluntary association (as per regs), within previous 2 years 27

29 Transition Provisions Grandfathering for provable existing business relationships gives implied consent until July 1, 2017 (unless unsubscribes): EBR in place on July 1, 2014 Over any time period (not usual 2 yr/6 mo. Period) Implied consent* until July 1, 2017 Where relationship including sending CEMs 28

30 Implied consent 3. Conspicuous publication of electronic address Where no caveat re unsolicited messages, and message relevant to business function, role or duties 4. Disclosure by recipient of business card info Where no caveat re unsolicited messages, and message relevant to business function, role or duties 29

31 Keep Records In all cases, it is up to you to be able to prove that you had consent to send a CEM, or that one of the exceptions applies. Do not risk sending a CEM if you can t prove consent or exception. Don t assume the Company will be able to prove. Ensure that 3 rd party list/info providers have ability to authorize you to send CEMs. 30

32 Qualifying Existing Contact Lists ID all business contacts Relationship? Relevance of message to recipient s biz? = B2B exemption (No consent or form) Conspicuous publication? No caveat? Relevance of message to recipient s biz? Deemed consent, but form required Direct disclosure? No caveat? Relevance of message to recipient s biz? Deemed consent, but form required Pre-July 1 privacy law compliant express consent? Existing express consent recognized under CASL (no form requirement) Obtain express consent or purge 31

33 If no applicable exception or implied consent, sender must have EXPRESS CONSENT

34 Request for Explicit Consent Must set out clearly and simply : Purpose or purposes for which consent sought Prescribed info identifying sender/person on whose behalf sent Name by which sender (or person on whose behalf message sent) carries on business If sent on behalf of another, identification of sender and on whose behalf sent Mailing address and one of telephone number, address or web address of sender/person on whose behalf sent Other prescribed info: Statement indicating that consent can be withdrawn And no pre-checked boxes 33

35 34

36 CEMs must* also be in the PRESCRIBED FORM

37 Prescribed Form for Messages identifies sender/person on whose behalf sent Name by which sender (or person on whose behalf message sent) carries on business If sent on behalf of another, identification of who sent, and on whose behalf contact info for sender/person on whose behalf sent Mailing address and one of telephone number, address or web address of sender/person on whose behalf sent No cost, easy unsubscribe mechanism: Same means as message sent, or other electronic means Gives Electronic address/web link for unsubscribe Set out clearly, must be able to be readily performed Effective without delay, no later than 10 business days 36

38 What You Have to Do WHEN SENDING A CEM

39 Check Before Sending CEMs Before any CEM is sent, make sure of the following: Eligible to send? Confirm you can demonstrate that you have the explicit consent of your recipients, or that they fall within one of the applicable exceptions. Identify yourself Identify yourself and the Company in the message. Ensure you include a mailing address and either a telephone number or address. Provide an unsubscribe mechanism Provide a working unsubscribe mechanism that allows the recipient to unsubscribe from receiving additional commercial electronic messages. 38

40 Implementation Checklist Current & Future Watch for further guidance re interpretation Review/modify formats for CEMs Ensure effective and timely unsubscribe Review/modify procedures for obtaining consent build into existing business processes/activities Ensure records are retained and retrievable Train personnel, develop processes to ensure lists developed in compliance Track time periods for exemptions, then auto-remove 39

41 40

42 41