Are You Sending Illegal s? Canada s Anti-Spam Legislation and How it Affects You

Transcription

1 Are You Sending Illegal s? Canada s Anti-Spam Legislation and How it Affects You Association of Corporate Counsel April 16, :30 EST Adrian Liu BLG Toronto aliu@blg.com Outline Canada s Anti-Spam Law (CASL) Introduction why it is important Status is it law? Who does it apply to? Details what is required? Enforcement/Penalties what are the risks? What you can do to prepare - 2-1

2 No Official Short Name An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act formerly ECPA (2009) and FISA (2010) Informally known as CASL Definition of Spam electronic message - message sent by any means of telecommunication, including text, sound, voice, image (not just ) electronic address - address for account, IM account, telephone account, or similar account (not just address) - 4-2

3 Definition of Spam commercial electronic message - one of its purposes (determined in light of the message content, external links, and content information) to encourage participation in a commercial activity commercial activity - any transaction, act or conduct of a commercial character, regardless of expectation of profit Definition of Spam person to whom message is sent - holder of the electronic address account and any other person it is reasonable to believe might be authorized by the account holder to use the electronic address - 6-3

4 The Perceived Need U.S. CAN-SPAM (2003) Canada only G8 country without specific anti-spam legislation Industry Canada Task Force on Stopping Spam (May 2005) Canada ranked #6 globally in list of worst countries for originating spam (2007) Privacy laws not sufficient Status of CASL Royal Assent on December 15, 2010 CRTC final regulations issued in March 2012 Draft Industry Canada regulations published for comment in January 2013 Consultation period ended in early February CASL expected to come into force sometime in

5 Application Anyone who sends a commercial electronic message A single counts and doesn t need to be sent to a consumer (businesses included) Anyone who installs a computer program on another person s computer, or provides a program for download Prohibits phishing (altering transmission data) CAN SPAM vs. CASL CAN SPAM CASL messages electronic mail only electronic message ( , text, sound, voice, image) to electronic address ( , IM, telephone, or similar account) definition of spam territorial scope primary purpose commercial not stated one of its purposes is commercial computer system in Canada used to send or receive CEM consent express opt-out opt-in consent (express or implied in limited circumstances), and cannot use CEM to request consent formalities prescribed content similar but different content secondary liability not stated directors, officers, agents of corporations employers of employees private action affected ISPs any affected individual / organization

6 Application Outside of Canada CASL applies if computer system in Canada used to send or access a prohibited CEM location of sender/recipient is irrelevant significant extraterritorial effect US business sending s to Canadians are caught substantial compliance challenges/costs for foreign businesses with customers in Canada Basic Requirements - Consent & Content/Formalities Prohibits sending a commercial electronic message (CEM) to an electronic address unless: the recipient has given express or implied consent (a consent requirement) and the CEM complies with prescribed formalities (a content/formalities requirement) An opt-in regime (unlike U.S. CAN-SPAM)

7 Exceptions from CASL Limited exceptions to CASL include: interactive two-way voice communications, faxes and vmail (governed by National Do Not Call List and Telemarketing Rules) CEMs between family members CEMs where there is a personal relationship inquiries regarding the recipient s commercial activity Intra- organization CEMs and CEMs between organizations if they have business relationship Express Consent Request for consent to receive CEM must clearly and simply specify: purpose for which consent is sought for the person requesting consent and the person on whose behalf consent is sought: identity business name and actual name (if different) contact information (physical and mailing address, telephone number, address and web address) statement that the recipient may withdraw consent by using any of the provided means Request for consent may be oral or written Different from privacy law consent

8 Express Consent Must be OPT-IN consent the box must be unchecked, and proactively checked by recipient Verbal consent possible, but must keep records Implied Consent Closed categories and time limited Existing business relationship in previous 2 years commercial transaction written contract Existing non-business relationship in previous 2 years donation/volunteer/membership in not-for-profit organization or club/association

9 Implied Consent Published Business Contact Information Recipient conspicuously published electronic address without prohibition and CEM is relevant to recipient's business or official capacity Provided Business Contact Information Recipient disclosed electronic address to sender without prohibition and CEM is relevant to recipient's business or official capacity Other Circumstances Burden Sender bears burden of establishing consent Transitional Exception (Partial) Consent is implied until notice revoking consent is given or until 3 years after CASL comes into force (whichever happens first) if: the sender and the recipient have an existing business or nonbusiness relationship on the date CASL comes into force and the relationship includes the communication of CEMs

10 Exceptions to Consent Requirement (formalities/content still required) Responding to Requests Messages responding to a request for quote or estimate for a commercial transaction Pending Transaction Messages that facilitate, complete or confirm a commercial transaction previously agreed to by the recipient Previous Transaction Messages that provide warranty, recall, safety or security information for a product or service used or purchased by the recipient Factual Notice Messages with factual information about ongoing use of a product or service under a subscription, membership or account purchased by the recipient Exceptions to Consent Requirement (formalities/content still required) Messages about Employment Messages that provide employment or benefits information Delivery Messages Messages that deliver products or services under a previous transaction

11 Formalities/Content Requirements Separate from consent requirement CEM must clearly and prominently : identify the person sending the CEM and the person on whose behalf the CEM is sent set out for both the person sending the CEM and the person on whose behalf the CEM is sent: business name and actual name (if different) contact information (physical and mailing address, telephone number, address and web address) Formalities/Content Requirements CEM must provide an effective/no cost unsubscribe mechanism: accessible using same electronic means that the CEM was sent or, if not practicable, an alternative electronic means CEM must also provide an electronic address or website to unsubscribe the unsubscribe mechanism must be able to be readily performed

12 Formalities/Content Requirements If not practicable to include prescribed information and unsubscribe mechanism in CEM, the information may be posted on a website readily accessible by a clear and prominent link in the CEM Other Offences Phishing Prohibits fraudulent data collection, including altering transmission data Software Prohibits installation of computer program, or use of program to send messages, without express consent Unauthorized Collection of Personal Information Prohibits collection of personal information from a computer using computer program or unauthorized access

13 Direct Liability Direct liability imposed on: CEM sender Persons that cause or permit a CEM to be sent Persons that aid, induce, or procure the sending of a CEM Secondary Liability Secondary liability imposed on: employers, who are liable for acts of employees/agents within scope of employment /agency corporate directors and officers, who are personally liable if they direct, authorize, or assent to, or acquiesce or participate in a contravention Due diligence defence (burden on defendant)

14 Enforcement CRTC - prohibited CEMs 3 year limitation period Competition Bureau - misleading CEMs Private right of action by any affected person class actions 3 year limitation period Enforcement Tools Robust Enforcement Tools preservation demands, production orders and search warrants for investigation and enforcement voluntary undertakings prevent private actions confession and penalties

15 Civil Penalties Administrative (non-criminal) monetary penalties for prohibited CEMs up to $1 million per violation for individuals up to $10 million per violation for organizations can be increased by regulations Unlimited fines and imprisonment for false/misleading messages Penalties Private Right of Action Private right of action summary determination (not a conventional trial) compensatory damages private fine up to $200 per message or up to $1 million per day risk of class actions

16 Preparing for Compliance Audit/Assessment Audit current practices, assess application of CASL Education Develop policies and training for employees Express Consent Establish procedures to collect, record and prove express consent renew consents before the law comes into effect or during the 3 year transition period for existing business relationships cull lists of non-conforming consents (significant risk of noncompliance) establish opt-in and renewal tools on contest entries, web pages, and applications Preparing for Compliance Implied Consent Establish procedures to verify, record and prove implied consent, including by reference to the 2-year rule difficult to do with organically-developed lists, at least looking backwards develop procedures to refresh lists on a rolling basis Formalities Develop internal procedures to ensure that all CEMs comply with prescribed formalities and are accurate

17 Preparing for Compliance Opting-Out Systems Develop internal procedures to implement opt-out notices no room for error 10 day grace period refresh existing procedures developed for privacy compliance Contracts Review contracts with resellers, distributors and marketing agencies for compliance, and conduct due diligence Preparing for Compliance Due Diligence Establish documented due diligence procedures for directors and officers Bulletins Reports Audits Monitoring/Responding Establish procedures for monitoring compliance and responding to violations in a timely way

18 Preparing for Compliance Insurance Consider insurance coverage (scope and limits) for liability arising from CASL violations Remember the Big Picture Don t forget other privacy and advertising obligations (or common sense) CASL consent is not a replacement for privacy consent BLG Advertising, Marketing and Sponsorship Group National Leaders Alexandra Nicol Montreal anicol@blg.com Eva Chan Toronto evachan@blg.com Regional Leaders LuAnne Morrow Calgary lmorrow@blg.com Victoria Prince Toronto vprince@blg.com Alexandra Nicol Montreal anicol@blg.com Robert J.C. Deane Vancouver rdeane@blg.com Yves J. Ménard Ottawa ymenard@blg.com

19 Privacy Blog To receive anti-spam updates, check out blg.com or our blog, The Law of Privacy in Canada at carswellprivacylaw.wordpress.com/ Questions? Adrian Liu Toronto aliu@blg.com