Guest post by: Shaun Brown
Industry Canada published draft Electronic Commerce Protection Regulations (the “Draft Regulations”) under Canada’s Anti-Spam Legislation (CASL) for comment in the Canada Gazette on January 5, 2013. Industry Canada and the Canadian Radio-television and Telecommunications Commission (CRTC) share responsibly for developing regulations under CASL, and since the CRTC published its Electronic Commerce Protection Regulations (CRTC) in March of 2012, the Industry Canada regulations remain the final outstanding piece of the legislative puzzle.
Industry Canada first published proposed regulations for comment in August, 2011, resulting in comments from 55 stakeholders, many of which are incorporated into the Draft Regulations. Industry Canada will be accepting comments on the Draft Regulations until February 4, 2013, with final regulations to follow some time thereafter.
The Draft Regulations – which contain the following provisions – will ease the compliance burden on businesses without undermining the objectives of preventing spam and related online threats:
- definitions for personal and family relationships;
- new exemptions for routine business communications;
- an allowance for third-party referrals;
- conditions for the use of consent collected on behalf of an unknown third party;
- specified computer programs where express consent may be deemed; and
- definitions of membership, club, association and voluntary organization.
Definition of personal relationship broader, more flexible, no “in-person” requirement
CASL exempts any commercial electronic message (CEM) sent between two persons who have a personal or family relationship, requiring Industry Canada to define both of these concepts in regulation.
A number of stakeholders commented that the definition of a “personal” relationship that appeared in the previously published regulations was too narrow, given the requirements for an “in-person” meeting as well as a two-way communication having taken place within the previous two years. Industry Canada removed both of these requirements.
The new definition in the Draft Regulations is based on a reasonableness test. If the sender and recipient have had a “direct, voluntary, two-way communication”, a personal relationship exists if it is reasonable to conclude that the relationship is personal based on “all relevant factors”, including (but not limited to):
- the sharing of interests, experiences, opinions and information evidenced in the communications;
- the frequency of communication;
- the length of time since the parties communicated; and
- if the parties have met in person. 1
This is a broader, more flexible definition that will allow senders to leverage relationships that have been formed through electronic communications.
The definition of a family relationship – which is drawn from the Income Tax Act – remains unchanged.
New exemption: business relationships
The Draft Regulations exempt any CEM sent by an employee, representative, contractor or franchisee of an organization to:
- another employee, representative, contractor or franchisee of that organization that concerns the affairs of the organization; or
- an employee, representative, contractor or franchisee of another organization if the organizations have a business relationship and the message concerns the affairs of the organization or that person’s role, functions or duties within or on behalf of the organization.
According to Industry Canada the purpose of this exemption is to address the “unintended application of CASL to ordinary, transactional business communications.” Without this exemption, the law would apply to these types of communications sent within and between organizations, potentially creating risk for employers who maintain email and other electronic messaging systems, as well as for the employees who use them for routine communications.
This will require an interpretation of a “business relationship”,2 as well as what it means for a CEM to “concern the affairs of the organization or [a] person’s role, functions or duties within or on behalf of the organization.” Presumably this exemption would not allow an employee of an organizations to solicit products or services to other employees without consent.
New Exemption: Responding to inquiries, etc.
A new exemption is added for any CEM that is “sent in response to a request, inquiry, complaint or is otherwise solicited by the person to whom the message is sent”.
CASL already establishes that an existing business relationship arises out of an inquiry or application from a consumer, allowing a business to send a reply message based on implied consent for a period of up to six months following the inquiry or application. However, in addition to being broader, the new exemption differs in a few important ways. Messages sent under the new exemption are exempted from CASL altogether, whereas a message sent based on implied consent must still meet the identification and unsubscribe requirements. In addition, there is no time limit on the ability to respond under the new exemption.
New Exemption: Messages sent when the sender does not know the recipient is in Canada
CASL applies to any CEM sent to or from a computer system located in Canada. This means that it would apply to any CEM sent to a Canadian – or even to a non-Canadian visiting Canada – regardless of where it was sent from, or if the sender meant to send the message to Canada.
A new exemption in the Draft Regulations would apply to any message accessed on a computer system located in Canada where:
- the message is sent by a person or from a computer system located outside of Canada;
- the message relates to a product, good, service or organization located or provided outside Canada; and
- the sender did not know and could not reasonably be expected to know that the message would be accessed using a computer system located in Canada.
This is a potentially significant exemption for non-Canadian senders who do not target Canadians in their campaigns, but may unknowingly have Canadian recipients on their list. As it is often impossible to know where an individual is located based on their email address (e.g., @gmail.com), this provides some degree of assurance that senders will not be caught by CASL for messages inadvertently sent to Canadians (or to a non-Canadian who accesses a CEM while visiting Canada).
New Exemption: Enforcing legal rights
Finally, the Draft Regulations would exempt any CEM sent to satisfy a legal obligation or enforce a legal right. Industry Canada states that this could apply to messages containing warranty or recall information, or copyright notices. This would also likely apply to debt collection notices.
Exemption from consent: third-party referrals
Many stakeholders commented on the fact that CASL would no longer allow professionals and salespeople to rely on third-party referrals to market their products and services. It is commonplace for individuals to refer to a family member, friend or colleague a professional with whom they have had a positive experience, providing the professional with an electronic address so that they can contact the family member/friend/colleague directly. However, because a sender requires express consent of the recipient (either written or verbal so long as it is recorded), this would no longer be allowed under CASL, even where an individual is expecting to hear from the sender. Although this may be less of an issue for large senders, it is has a particularly significant impact on small businesses in Canada, even though third-party referrals are not known to be a source of spam.
A new exemption would allow a professional to send a single message without consent based on a third-party referral, so long as the following conditions are met:
- the person making the referral has an existing business relationship, an existing non-business relationship, a personal relationship or a family relationship with both the sender and the recipient; and,
- the sender discloses the name of the person making the referral in the message and that the message is sent as a result of the referral.
This is an important exemption as it will allow businesses to continue to use email and other forms of electronic messaging to continue reaching out to consumers without compromising the anti-spam objectives of CASL.
Conditions for use of consent
The Draft Regulations establish the conditions for the use of express consent obtained by one person on behalf of another person, the identity of which is unknown at the time consent is obtained. In other words, these rules apply where an electronic address is collected by one person, and later shared with another person (as opposed to one person sending the content of another person to their list). The Draft Regulations require the name of the person who originally obtained consent to be identified in any message sent to the recipient, and that the unsubscribe mechanism allow the recipient to unsubscribe from receiving messages from any person who has been provided with their electronic address. The consent management/unsubscribe process therefore requires coordination across organizations.
This section of the Draft Regulations remains unchanged from the previous version of regulations published in 2011. Although some stakeholders commented that the section was overly complicated, Industry Canada stated that no alternative regulatory approaches where identified. It is worth noting that any time one organization seeks to share email addresses with another sender, this raises issues that are inherently complex, resulting in rules that are equally complicated.
Specified computer programs
CASL deems a person to have expressly consented to the installation of certain categories of computer programs where “the person’s conduct is such that it is reasonable to believe that they consent to the program’s installation.” The Draft Regulations expand the categories of computer programs listed under this section to allow telecommunications service providers to install programs on its customers’ computers or devices in order to prevent illegal activities (e.g., network hacking), or for the purposes of updating or upgrading a network.
Definitions of membership, club, association and voluntary organization remain unchanged
For the purposes of CASL, membership is defined as “the status of having been accepted as a member of a club, association or voluntary organization in accordance with its membership requirements.”
A club, association or voluntary organization is defined as:
- A non-profit organization that is organized and operated exclusively for social welfare, civic improvement, pleasure or recreation or for any purpose other than profit, if no part of its income is payable to, or otherwise available for the personal benefit of any proprietor, member or shareholder of that organization unless the proprietor, member or shareholder is an organization whose primary purpose is the promotion of amateur athletics in Canada.
These definitions are necessary for the purposes of the existing non-business relationship under the implied consent provisions.
Issues not addressed in the Draft Regulations
In commenting on the Draft Regulations, Industry Canada noted that it chose not to accommodate the following requests from stakeholders:
- a form of “grandfather” clause that would recognize consent obtained previously under the Personal Information Protection and Electronic Documents Act (PIPEDA) as valid under CASL;
- an exemption for CEMs sent by Canadian service providers on behalf of foreign senders to foreign recipients; and,
- a provision that would allow manufacturers to send CEMs to recipients who have purchased their products from a retailer.
Industry Canada did indicate that some issues may be addressed in compliance guidelines, possibly developed in conjunction with the Canadian Radio-television Telecommunications Commission (CRTC). In particular, Industry Canada referred to the confusion arising out of the provisions that purport to exempt certain forms of transactional-type messages from the need for consent (but not from the identification and unsubscribe requirements), as well as apparent misunderstanding over the application of CASL to social media.
About the author:
Shaun Brown is a partner with nNovation LLP, a pre-eminent Canadian law firm that advises private and public sector organizations in connection with a broad range of Canadian regulatory regimes. With several years of experience both in the public and private sectors, Shaun’s practice focuses on e-marketing, e-commerce, privacy, and access to information. Subscribe to Shaun’s Privacy newsletter at PrivacyScan.
1 This exemption does not apply if the recipient has previously indicated that they do not want to receive CEMs from the sender.
2 It is not clear how a “business relationship” for the purposes of this regulation would differ from an “existing business relationship” as defined in the implied consent provisions of CASL. Presumably Industry Canada intends for this exemption to apply only to relationships that are ongoing, as opposed to an existing business relationship, which is deemed to exist for up to 24 months following a sale, contract, etc.
This summary is provided for informational purposes only, and is not intended as legal advice.
