casl and common sense: coming to grips with canada’s anti-spam law professor michael geist...
TRANSCRIPT
CASL and Common Sense:Coming to Grips With Canada’s Anti-Spam Law
professor michael geist
university of ottawa, faculty of law
CASL• Task Force conclusion - opt-in consent backed by penalties• Long delay in responding to recommendations• ECPA introduced in May 2009; dies with prorogation• FISA (re)introduced in May 2010• Bill receives royal assent in December 2010• Regs introduced in June 2011 • Regs reintroduced in January 2013• Law took effect in July 2014• Phased-in – elements take effect in 2015, 2017
CASL - The Basics• Only applies to commercial electronic messages:
– Having regard to content, links, etc.:(a) offers to purchase, sell, barter or lease a product,
goods, a service, land or an interest or right in land;(b) offers to provide a business, investment or gaming
opportunity;(c) advertises or promotes anything referred to in
paragraph (a) or (b); or(d) promotes a person, including the public image of a
person, as being a person who does anything referred to in any of paragraphs (a) to (c), or who intends to do so.
• Exception for law enforcement
CASL - The Basics
Key prohibition – no sending CEMs unless:
1. Consent2. Form requirements3. Opt-Out
CASL - The Basics• Key prohibition - send or cause or permit to be sent to an
electronic address a commercial electronic message unless:(a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and(b) message meets form requirements– Identifies sender– Sender contact information (valid for 60 days)– Unsubscribe mechanism
• Enable person to unsubscribe via email at no cost• Offer a web-based unsubscribe function• Must take off list within 10 days
• Does not matter if message is received
CASL - The Exceptions• Personal or family relationships• Business-to-business (if consists solely of inquiry related to
commercial activity)• Quote or estimate for product or service if requested by recipient• Confirms previously completed commercial transaction• Warranty information• Product recall information• Safety or security information about a product• Factual information on ongoing transaction such as subscription,
membership, account, loan, etc.• Employment relationship• Product upgrades• Telco providers merely providing telecommunications services
CASL – The Exceptions (via Regs)• Numerous additional exceptions:
– Charities– Third party referrals– Broad definition for personal relationship– Legal or juridical obligations– Expanded business-to-business– Jurisdiction
CASL- The Consent• Can be implied consent if:
– Existing business relationship• Purchase or lease of any product, service, etc. over prior 2 year period• Business, investment, gaming opportunity over prior 2 year period• Bartering of good, service, etc.• Written contract• Inquiry within past six months
– Existing non-business relationship• Donation or gift to registered charity over prior 2 year period• Donation or gift to political party or candidate over prior 2 year
period• Volunteer work over prior 2 year period (charity, political party,
candidate)• Membership in a club, association, etc. over 2 year period (in regs)
– Person conspicuously publishes email address– Person discloses email address to sender
CASL - Additional Prohibitions
• No altering transmission data without consent– Exception for network management
• No installing computer programs without consent• No installing computer programs and using to send
electronic messages
CASL- Additional Prohibitions• Statute identifies requirements for express consent
– For computer programs includes describing function and purpose of the program
– Additional express consent requirement (w/description) if program:• Collects personal information• Interferes with control of personal computer• Changes settings• Interferes with data• Communicates with other computers without consent• Installs another program
• Doesn’t apply:– to computer upgrades where user has given broad consent– cookies, HTML, JavaScripts, OS– Where reasonable to assume has given consent
CASL - Additional Prohibitions• Competition Act violations
– New false or misleading representations in electronic message• Sender information• Content• Locator information
– These apply whether or not deceived• PIPEDA Violations
– Collection of email addresses if used by program designed to capture email addresses– Use of email addresses if collected from program (as above)– Commissioner has some discretion on investigation
• Telecommunications Act– Possible replacement of do-not-call list
CASL - Penalties/Enforce• Preservation orders - may require telco to preserve data
– Valid for 21 days– May be extended once– May limit disclosure of preservation order for up to six months– Telco must preserve for up to six months; destroy thereafter– Within 5 days, can ask CRTC to review if undue burden– CRTC can vary, rescind, etc.
• Production order– May require production of document or data– Similar standards as preservation orders (no disclosure, CRTC review)
• Warrants– Enter premises to ensure compliance, investigate violations
CASL - Penalties/Enforce• AMPs
– $1,000,000 for individual per violation– $10,000,000 for corporation per violation
• Undertakings– Essentially a settlement of forthcoming notice of violation
• Notice of Violation– Set out violations, penalties, etc.
• Injunctions
CASL- Private Right of Action• Can bring action to court within three years of violation• No action against someone who has agreed to an
undertaking• CRTC, Competition Bureau, OPC may all intervene• Court can order up to $1,000,000 per violation