Canada s New Anti-Spam Law

Transcription

1 Canada s New Anti-Spam Law Will Your Business be Ready Stikeman Elliott Seminar February 13, 2014 David Elder MONTRÉAL TORONTO OTTAWA CALGARY VANCOUVER NEW YORK LONDON SYDNEY

2 Overview of Key Elements

3 in a Nutshell Commercial Electronic Messages Prohibits sending commercial electronic messages without express consent Some exceptions Installation of Computer Programs Prohibits the installation of a computer program without express consent Some exceptions Alteration/Rerouting Prohibits the alteration of transmission data or rerouting of messages without express consent 2

4 Related Amendments Competition Act PIPEDA Telecom Act CRTC Act New offenses re false & misleading online reps Sender ID, subject line, URL Removes exceptions to consent for address harvesting & collection of personal information through hacking Clarifies CRTC authority under Telecom Act limited to telemarketing Establishes CRTC as enforcement agency for CASL 3

5 Enforcement AMPs for violations (Up to $ 1 M individual, $ 10 M corporate) Undertakings Public shaming Registration with court enforced as contempt Injunctions, Restraining Orders Offences Private right of action Preservation demand Notice to produce Search warrant 4

6 CASL Regime Key Components Regulatory Impact Analysis Statement CASL Electronic Commerce Protecion Regulations Electronic Commerce Protecion Regulations (CRTC) Order SI-TR Telecom Regulatory Policy CRTC Compliance and Enforcement Bulletins CRTC /549 FAQs MOU re cooperation, coordination and info sharing 5

7 CASL Timeline 6

8 The Countdown has Begun Days until July 1 Working Days until July 1 7

9 Installation of Computer Programs SLIDE 8

10 Installation of Computer Program Must not install/cause to be installed a computer program on other s computer system Installed program must not cause electronic message to be sent from computer system Unless: Express consent of owner/authorized user Provide electronic address for remove/disable for 1 year Provide no-cost assistance re remove/disable request Acting pursuant to court order 9

11 Deemed Consent Cookies Html Code Java Scripts Operating System Executable only with program installed with consent Express Consent Must set out clearly: Purpose for consent Installer identification General Description of program function and purpose Enhanced Consent In addition to Express Consent: Separate from licence agreement Detailed description of material elements, including likely impact on user Greater prominence Explicit agreement form user to unexpected functions 10

12 11

13 Unsolicited Electronic Messages SLIDE 12

14 Core Anti-Spam Provision It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless: 1. One of the statutory exceptions applies, or 2. The sender has the express or implied consent of the recipient and the message is in the prescribed form 13

15 Q1: Is the message A COMMERCIAL ELECTRONIC MESSAGE?

16 Commercial Electronic Message An electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that a. offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land; b. offers to provide a business, investment or gaming opportunity; c. advertises or promotes anything referred to in paragraph (a) or (b); or d. promotes a person, including the public image of a person, as being a person who does anything referred to in any of paragraphs a) to (c), or who intends to do so. 15

17 Q2: Does the message fit within a STATUTORY EXEMPTION?

18 Exceptions from Consent and Form of Message Requirements PART 1 Sent by individual to individual with whom have a personal/family relationship personal relationship = direct, voluntary 2-way communications, reasonable to conclude personal, no indication don t want to receive CEMs family relationship = marriage, common-law, parent-child Sent to business, message consists solely of a related inquiry/application or that business s response Internal CEMs concerning affairs of that organization External B2B CEMs, where is a relationship, message concerns affairs of organization or recipient employee, rep., consultant or franchisee s role, duties or functions 17

19 Exceptions from Consent and Form of Message Requirements PART 2 Sent to: Satisfy a legal or juridical obligation Provide notice of or enforce a right, court order, judgment or tariff Enforce a right arising under federal, provincial, municipal or foreign law Sent & received on electronic messaging services, with conspicuous unsubscribe, implicit or explicit consent to receive Sent on closed secure account by provider of account Will be accessed in foreign state, complies with local anti-spam law Sent by or on behalf of a registered charity, primary purpose is fundraising Sent by or on behalf of a political organization or candidate, primary purpose is fundraising Interactive voice, fax calls or voice recordings sent to telephone account as provided in regulations 18

20 Exceptions from Consent Requirement Only PART 1 Provides a quote or estimate, where requested by recipient Facilitates, completes or confirms a commercial transaction to which recipient previously agreed Provides warranty, recall, safety or security information about a product/good/service that recipient purchased Provides notification of factual info re ongoing subscription or membership Provides info to employee re employment, benefits Delivers a product, good or service entitled to receive 19

21 Exceptions from Consent Requirement Only PART 2 Communicates for purpose set out in regulations First CEM sent following a referral by person with an existing business or non-business relationship, as defined a personal or family relationship (but not as defined?) with both sender and recipient where CEM discloses full name of referrer and states the message was sent as a result of the referral 20

22 Q3: Does the sender have IMPLIED CONSENT?

23 4 Scenarios for Implied Consent 1 Existing Business Relationship 2 Existing Non-Business Relationship 3 Conspicuous Publication of Electronic Address 4 Disclosure of Electronic Address by Recipient 22

24 Implied consent 1. Existing business relationship: Purchase, sale or barter of goods/services within previous 2 years Acceptance of business opportunity within previous 2 years Written contract, in force, or expired within previous 2 years Inquiry or application re purchase, sale, barter or business opportunity within previous 6 months 2. Existing non-business relationship: Donation/gift to, or volunteer work for registered charity, political party or organization, candidate for public office within previous 2 years Membership in club, association or voluntary association (as per regs), within previous 2 years 23

25 Existing Business Relationship 10(9) Consent is implied for the purpose of section 6 only if a) the person who sends the message, the person who causes it to be sent or the person who permits it to be sent has an existing business relationship or an existing non-business relationship with the person to whom it is sent; 10 (10) In subsection (9), existing business relationship means a business relationship between the person to whom the message is sent and any of the other persons referred to in that subsection that is, any person who sent or caused or permitted to be sent the message arising from 24

26 Existing Business Relationship a. the purchase or lease of a product, goods, a service, land or an interest or right in land, within the two-year period immediately before the day on which the message was sent, by the person to whom the message is sent from any of those other persons; b. the acceptance by the person to whom the message is sent, within the period referred to in paragraph (a), of a business, investment or gaming opportunity offered by any of those other persons; c. The bartering of anything mentioned in paragraph (a) between the person to whom the message is sent and any of those persons within the period referred to in that paragraph; 25

27 Existing Business Relationship d. a written contract entered into between the person to whom the message is sent and any of those other persons in respect of a matter not referred to in any of paragraphs (a) to (c), if the contract is currently in existence or expired within the period referred to in paragraph (a); or e. an inquiry or application, within the six-month period immediately before the day on which the message was sent, made by the person to whom the message is sent to any of those other persons, in respect of anything mentioned in any of paragraphs (a) to (c). 26

28 Implied consent 3. Conspicuous publication of electronic address Where no caveat re unsolicited messages, and message relevant to business function, role or duties 4. Disclosure by recipient of business card info Where no caveat re unsolicited messages, and message relevant to business function, role or duties 27

29 If no applicable exception or implied consent, sender must have EXPRESS CONSENT

30 Request for Express Consent Must set out clearly and simply : Purpose or purposes for which consent sought Prescribed info identifying sender/person on whose behalf sent Name by which sender (or person on whose behalf message sent) carries on business If sent on behalf of another, identification of sender and on whose behalf sent Mailing address and one of telephone number, address or web address of sender/person on whose behalf sent Other prescribed info: Statement indicating that consent can be withdrawn And no pre-checked boxes 29

31 30

32 Consent on Behalf of Unknown Parties Retail Partner Airline Partner Hotel Partner Financial Partner 31

33 CEMs must* also be in the PRESCRIBED FORM

34 Prescribed Form for Messages identifies sender/person on whose behalf sent Name by which sender (or person on whose behalf message sent) carries on business If sent on behalf of another, identification of who sent, and on whose behalf contact info for sender/person on whose behalf sent Mailing address and one of telephone number, address or web address of sender/person on whose behalf sent No cost, easy unsubscribe mechanism: Same means as message sent, or other electronic means Gives Electronic address/web link for unsubscribe Set out clearly, must be able to be readily performed Effective without delay, no later than 10 business days 33

35 Transition Provisions Transitional Grandfathered existing business and non-business relationships implied consent for existing business or non-business relationship over any time period (i.e. not constrained by usual 2 year period) where that relationship included sending commercial electronic messages Applies for 3 years after coming into force, unless recipient unsubscribes The intent of the three year transitional period is to obtain consent. RIAS Previously obtained express consents remain valid under the new law until revoked 34

36 Key Outstanding Issues for Business 1. What qualifies as a CEM? 2. Unsubscribe required for service messages? 3. What qualifies as a relationship for B2B exemption? 4. How to avoid liability in forward-to-a-friend campaigns? 5. How to qualify an existing contact list? 6. How to demonstrate eligibility for exemptions, implied consent, particularly EBR re grandfathering provision? 7. Infrastructure re cascading un-subscribes 35

37 Implementation Checklist Current & Future Watch for further guidance re interpretation Review/modify formats for emarketing Ensure effective and timely unsubscribe Review/modify procedures for obtaining consent Ensure records are retained and retrievable Train personnel, develop processes to ensure lists developed in compliance Track time periods for exemptions, then auto-remove 36

38 Qualifying Existing Marketing Lists ID all business contacts Relationship? Relevance? = B2B exemption (No consent or form) Existing Contract? Sale or expired contract w/in 2 yrs? = EBR (deemed consent, but form required) Conspicuous publication? No caveat? Relevant? Deemed consent, but form required Direct disclosure? No caveat? Relevant? Deemed consent, but form required Pre-July 1 privacy law compliant express consent? Existing express consent recognized under CASL (no form requirement) Obtain express consent or purge 37

39 38

40 Questions and Answers David Elder (613)