On Dec. 4, 2013, the Government of Canada published the final regulations to Canada’s Anti-Spam Legislation along with the related Regulatory Impact Analysis Statement. After three years of waiting, most of CASL, including the sections dealing with commercial electronic messages, will finally come into force on July 1. Mercifully, those sections of the act relating to the installation of computer programs will only come into force on Jan. 15, 2015, and the coming into force of the new private right of action for non-compliance with CASL will only be implemented July 1, 2017.
While compliance with CASL has been the subject of discussion by lawyers for years, the truth is many businesses have been caught unaware as they waited to see how Industry Canada would sort out some of the most problematic aspects of this act. Unfortunately, while some changes have been made in the regulations to address practical concerns, the act remains a tortured mess, full of technicalities and gaps.
Rather than deter spam, it seems instead to have been designed to provide meaningful employment for technology lawyers over the next few years as we endeavour to parse out the act’s ambiguities and provide meaningful guidance to our clients.
Unfortunately, the government is not making it particularly easy for lawyers practising in this area, let alone our clients. There are myriad flaws in the sections dealing with commercial electronic messages (never mind the remainder of the act dealing with unsolicited installation of computer programs) but I will focus on a few obvious ones.
Industry Canada seems to have a very odd view of the modern Canadian family since the exceptions relating to “family relationships” only encompass relationships between two people related through marriage, common law partnership, or legal parent-child relationships. I certainly hope my sisters will be able to rely on the companion “personal relationship” exemption, not to mention my aunts, uncles, and cousins, to communicate with me. Since my grandparents are no longer with us, I don’t have to worry about them, but is this really something anyone needs to think about?
The regulations clarified that in order to “reduce regulatory duplication in situations where CEMS are sent from Canada to other states that have their own regulatory requirements” CASL will not apply when messages are sent from Canada to any of the states listed in Schedule 1 of the regulations (most of the world, including the United States, members of the European Union, Australia, New Zealand, China, and Japan) that have their own anti-spam legislation, as long as the commercial electronic message complies with that country’s anti-spam laws “which address conduct that is substantially similar to conduct prohibited under the Act.”
This “exemption” applies when the person who sends the message or causes or permits it to be sent “reasonably believes” the message will be accessed in the foreign state.
The RIAS states this “exclusion” was added to the regulations to mitigate the “regulatory burden” of requiring businesses to comply with both foreign laws and CASL but I genuinely cannot see how this makes the situation better if senders of messages are still obliged to ponder their compliance with both CASL and “applicable” foreign law to see if they even meet this so-called “exemption.”
Am I the only person who thinks it odd that one of the key definitions in the act, that of “commercial electronic message,” is so broad and convoluted? Who decides whether “it would be reasonable to conclude as its purpose, or one of its purposes, to encourage participation in a commercial activity?” What is this analysis actually based on?
The Regulatory Impact Analysis Statement itself states that to clarify the scope of the act, “guidelines are more appropriate than Regulations,” but it must be remembered the RIAS is merely a guidance/interpretation document and of no legally binding effect.
The statement says to the extent a message is sent in a pre-existing commercial context but does not fall within the definition of CEM provided in ss. 1(2) and (3) it is not a CEM — the mere fact a message involves commercial activity, hyperlinks to a person’s web site, or business-related electronic addressing information does not make it a commercial electronic message “if none of its purposes is to encourage the recipient in additional commercial activity.”
The RIAS then says electronic messages may come within the definition of a CEM “if it would be reasonable to conclude that one of the purposes is to encourage the recipient to engage in additional commercial activities, based on, for example, the prevalence and amount of commercial content, hyperlinks or contact information.”
Is this really helpful? How would one be expected to evaluate and measure “prevalence and amount?” It seems rather subjective and vague and designed to err on the side of inclusion rather than exclusion to ensure compliance with the act’s onerous requirements.
One of our government’s nastier decisions regarding this legislation was its refusal in the regulations to recognize implied consents previously obtained under Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act.
While the RIAS confirmed that “express consents, obtained before CASL comes into force, to collect or use electronic addresses to send commercial electronic messages will be recognized as being compliant with PIPEDA,” implied consents will not be recognized, i.e. if there is no longer an exclusion nor any form of consent under CASL.
Can someone please explain to me why the government refused to consider these as valid? This single decision will cause enormous headaches for companies that have not systematically differentiated between collecting e-mail addresses on the basis of express or implied consent. So companies that had previously collected e-mail addresses on the basis of what they thought to be valid implied consents under PIPEDA will now have to move quickly to collect valid express consents before July 1, failing which they will have to rely on much narrower CASL-compliant “implied consents” to continue communicating. Since many individuals ignore their e-mail, non-replies will have to be removed from CASL-compliant databases unless other exemptions can be found.
Oddly, while the RIAS lauds the importance of clarifying issues through guidelines, it is abundantly clear our pending anti-spam legislation is just a “work in progress” and the government itself is still figuring it out. Why else would they feel the need to reassure a panicking constituency that “together, the CRTC and Industry Canada will issue new Frequently Asked Questions and Responses on the CRTC and Fightspam.gc.ca web sites?”
Am I supposed to be comforted? How quickly will these clarifications happen? Before or after July 1? And what about the fact the RIAS itself noted the “the previous guidance issued by the CRTC on October 10, 2012 are not legally binding.” Stay tuned for further updates!
Is this really the best the federal government can do?
I could go on and talk about the convoluted regulation rules regarding third-party referral marketing/promotions, the difficult conditions for use of consent, etc. While all of this might be academically interesting, the problem is, unlike certain other Canadian statutes, CASL is “law with teeth.”
By way of reminder, while the act explicitly says the purpose of penalties is to “promote compliance” with the act and not to punish, the fact remains that individuals are subject, per violation, to administrative monetary fines in the amount of $1 million with companies subject to fines of $10 million as well as additional fines for non-compliance with the act. Ouch.
There is no doubt spam is a scourge, but isn’t it obvious after three years, the real answer is to stop trying to fix a fundamentally flawed piece of legislation using regulations and non-binding guidance documents and instead scrap CASL altogether and draft something balanced, clear, and not designed to drive business away from Canada? Even if it means fewer billable hours for me over the next few months?
