On July 1, 2017, the private right of action under Canada’s Anti-Spam Legislation (CASL) will come into force. Largely enacted in January 2014, CASL regulates: (i) the transmission of commercial electronic messages without the consent of the recipient, (ii) installation of computer programs (e.g. malware) on a device without consent, and (iii) sending false or misleading electronic messages. To this point, enforcement for violations of CASL has been left to the CRTC. However, with the advent of the private right of action, individuals and organizations will now have a direct right of action against organizations alleged to have breached CASL’s provisions. This is expected to give rise to a number of class actions, many of which will likely be commenced very shortly after the right of action takes effect.
Under the private right of action, organizations (as well as their officers, directors and agents) can be sued where someone claims to have been “affected” by an act or omission that violates CASL. Plaintiffs can claim both compensatory damages (for any actual losses or damages they may have suffered) as well as prescribed statutory damages.
The potential exposure to an organization under the statutory damages caps alone is significant. For example, each non-compliant email sent could result in damages of $200, up to a maximum of $1,000,000 per day. An organization that regularly uses email as a form of mass marketing could quickly reach the $1,000,000 per day maximum.
It is not expected that there will be a material volume of individual actions brought pursuant to the private right of action, given the relatively modest recovery that an individual could potentially receive. Rather, the private right of action is ripe for use by class actions lawyers, who will be quick to take advantage of its enactment to seek to certify multi-million dollar actions. Anti-spam class actions against a number of prominent companies have already been brought in the U.S. The expected volume of class actions are at the forefront of risks that Canadian organizations face once the private right of action comes into force.
If they are not already, organizations should be assessing and mitigating their risk of individual and class action under the private right of action, with the guidance of experienced counsel. Osler has written extensively on compliance with CASL more broadly and the private right of action specifically. For useful background resources, please see the following:
- CASL compliance: more than spam
- Preparing for CASL’s private right of action
- Private right of action under CASL is coming into force
- CASL’s first compliance and enforcement decision: lessons learned
By: Kevin O’Brien, Lauren Harper and Evan Thomas, Osler, Hoskin & Harcourt LLP
Occasional Contributors
Latest posts by Occasional Contributors (see all)
- Genetic Non-Discrimination Act upheld by the Supreme Court: Implications for insurers - September 21, 2020
- Let’s talk about assumptions and risk - September 11, 2020
- Treat cyber as a business risk - August 31, 2020
I’m waiting with some interest to see if there is a class action against Microsoft for imposing an unwanted “upgrade”. Both the law ands the facts of the case are fascinating.