Privacy Dimensions to Canada's Anti-Spam Legislation (CASL)

Transcription

1 Privacy Dimensions to Canada's Anti-Spam Legislation (CASL) IAPP Canada Privacy Symposium 2012 May 9 11, 2012 Toronto, Ontario Michael De Santis, Legal Counsel Office of the Privacy Commissioner of Canada

2 CASL and the OPC An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act = CASL CASL makes important changes to the Personal Information Protection and Electronic Documents Act or PIPEDA PIPEDA is enforced by the Office of the Privacy Commissioner of Canada or the OPC

3 What is Spam and why does it matter? Spam is the colloquial term which describes the use of electronic messaging systems to distribute unsolicited bulk messages. Under CASL, even a single unsolicited, commercial electronic message may be unlawful. Spam messages form a large majority of all messages sent. In January 2012, Symantec calculated that one in every messages world-wide was spam, up 1.3% since December Source: Symantec Intelligence Report January 20123

4 What is Spam and why does it matter? In Canada, 68.7% of traffic during the month of January 2012 was spam. One in every 380 sent in Canada during the month of January 2012 contained a phishing attempt. One in every 285 sent in Canada during the month of January 2012 contained some form of malware. Such statistics are of particular concern to the OPC, as we are tasked with protecting Canadians from electronic address harvesting and spyware. Source: Symantec Intelligence Report January

5 What is Spam and why does it matter? Spam reduces the confidence of users in different forms of electronic communication through false positives and false negatives. Spam causes almost incalculable productivity loss, IT costs and it is a major vector for corporate data and security breaches. A study for computer protection company McAfee showed that globally, spam uses 33 billion kilowatt hours (KWh) a year - enough energy to power 2.4million homes or 3.1 million cars. Source: McAfee The Carbon Footprint of Spam

6 What is Spam and why does it matter? Spam is also a very significant privacy problem. Spammers collect and use personal information, such as addresses, without the consent of the user. Additionally, spammers collect additional personal data for individuals who respond to their messages, creating additional privacy risks.

7

8 Why do people receive spam messages? Spam is a profitable enterprise and the cost of delivering messages to users all around the world is negligible in comparison to other forms of communication. An academic study analyzed a small portion of a spam botnet (the Storm botnet) that had sent 350 million messages in 26 days. 28 sales resulted from those 350 million messages for a conversion rate of %. Despite this low percentage, the study estimated that the Storm botnet likely generated between $ USD per day in gross revenues for its operators. Source: Spamalitics: An Empirical Analysis of Spam Marketing Conversion

9 Privacy and Legal Protection against Spam prior to CASL Prior to CASL, there were some limited forms of recourse to mitigate spam. Individuals could attempt to seek redress from the Privacy Commissioner, Competition Bureau, or the Police. Individuals could also attempt to seek enforcement of an Internet Service Provider s (or ISP ) terms of use or pursue civil remedies. 9

10 Privacy and Legal Protection against Spam prior to CASL The OPC has considered an individual s address and their IP address to be their personal information under PIPEDA in certain circumstances. PIPEDA requires the consent of the individual to use their personal information in the context of a commercial activity. PIPEDA Case Summary # : An individual complained that a sports organization had collected and used his personal information, specifically, his business address, without his consent. The OPC found his complaint to be well-founded. PIPEDA Case Summary # : An individual complained to our Office that a car manufacturer had, without consent, used the address he d provided in connection with a vehicle repair dispute to send him advertising materials. The OPC found his complaint to be well-founded.

11 Privacy and Legal Protection against Spam prior to CASL There have been cases heard before the courts regarding spam Ontario Inc. v. Nexx Online Inc.:The plaintiffs through a third party were sending unsolicited bulk through the Internet at the rate of 200,000 s per day. The defendant service provider warned the plaintiffs that if they did not cease sending the bulk e- mails through the third party, they would deactivate their website as contravening the parties governing contract. The plaintiffs continued sending out bulk s. The defendant disconnected the plaintiff s website. The Court found that the plaintiff was in breach of the terms service for his ISP and the disconnection was justified. Facebook Inc. v. Guerbuez.: The defendant was fined $873 million USD by a California court for violating the U.S. CAN-SPAM Act by sending over 4 million unsolicited commercial messages over Facebook. The Québec Superior Court upheld this judgment against the defendant.

12 The Genesis of CASL On May 25 th, 2010, the Honourable Tony Clement, Minister of Industry, introduced Bill C-28 (CASL). Bill C-28 was an updated version of Bill C-27 from the 2 nd session of the 40 th Parliament. Bill C-27 died on the order paper due to the prorogation of Parliament on December Bill C-28 contained much of the text of C-28, with some additional changes. CASL is the result of a process that began with the Anti-Spam Action Plan for Canada which was launched by the Government of Canada in This Plan established a private-sector task force chaired by Industry Canada to examine the issue of spam. The Task Force on Spam led a round table of national stakeholders in December of They issued a report in May 2005 regarding the spam situation in Canada which recommended, among other things, legislation which specifically combats spam.

13 CASL and Privacy Protection for Canadians Prior to CASL, there was no comprehensive system of enforcement with respect to spam in Canada. CASL gives responsibility for anti-spam enforcement to three primary enforcement agencies: the Competition Bureau, the CRTC and the OPC. CASL contains some important amendments to PIPEDA, now in force, which will give the OPC new powers to investigate spam complaints which will give the OPC the ability to better manage its investigative resources and share information with provincial and foreign counterparts.

14 CASL and Privacy Protection for Canadians Under the current language of PIPEDA, there are exceptional circumstances defined in s.7 where personal information can be collected, used or disclosed by a private sector organization without consent, such as during life-threatening emergencies and for debt collection. CASL negates most of these exceptions for the collection and/or use of an electronic address that was obtained by data mining or address harvesting. Similarly, a number of the exceptions are negated for electronic addresses collected by accessing computers in an unlawful way, such as through the use of spyware.

15 CASL and Privacy Protection for Canadians CASL grants the Commissioner a new discretionary power to refuse to investigate complaints under certain circumstances, such as: 1. The Complainant has not exhausted all review or grievance procedures available to him or her. 2. The Complaint could be more appropriately dealt with by a procedure under a different law 3. The Complaint was not filed within a reasonable amount of time. This new discretion will allow the OPC to make better use of resources to investigate systemic issues

16 CASL and Privacy Protection for Canadians Previously, the Commissioner could consult with provincial DPAs and enter into agreements with them to coordinate activities or provide mechanisms to handle complaints in which they are mutually interested. CASL has amended PIPEDA to allow the OPC to share confidential information with provincial DPAs regarding ongoing investigations or audits or to assist the Commissioner in her duties to protect personal information.

17 CASL and Privacy Protection for Canadians CASL has amended PIPEDA which now contains clauses enhancing the Commissioner s ability to protect privacy in the international context. PIPEDA sections amended by CASL allow the Commissioner to disclose information to foreign DPAs that could be relevant to an investigation or proceeding in respect of a contravention of the laws of another state. The Commissioner may only make use of this new power if there is a written arrangement with the foreign DPA which limits the disclosure and use of the information to the purpose for which it was originally shared and stipulates that the information be treated in a confidential manner and not further disclosed.

18 Take Aways The proliferation of spam is a significant problem which affects Canadian citizens and businesses. CASL creates a coordinated approach for enforcement agencies in Canada to address the spam issue. The OPC has been granted new powers under CASL which will enable it to combat spam more effectively, preserve the privacy rights of Canadians and coordinate its efforts to protect personal information with provincial and foreign governments. 18

19 Questions?? 19

20 Thank you Merci