• First Reference
  • About us
  • Contact us
  • Free Coronavirus FAQ 🔬
  • Free Newsletter 📨
  • Get PolicyPro Free Trial 🎉

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
You are here: Home / Business / CASL “take 2”: New provisions coming for January 2015

By Occasional Contributors | 3 Minutes Read December 23, 2014

CASL “take 2”: New provisions coming for January 2015

Author: Xavier Beauchamp-Tremblay, Norton Rose Fulbright LLP
The entry into force of the first group of provisions of Canada’s anti-spam act [1] (CASL) on July 1, 2014, (the Spam Provisions) generated considerable attention. Now that businesses have (hopefully) determined and deployed their compliance strategy for the Spam Provisions, another set of articles from CASL is about to come into force on January 15, 2015. These provisions will prohibit the installation of computer programs on another person’s computer absent express consent.
The government’s communications regarding the new set of provisions rightly focus on the fact that its immediate objective is to fight malware and viruses and, as such, most businesses would not feel immediately preoccupied (or at least concerned) by the new provisions. However, the drafting of the provisions is very broad and could apply to numerous “legitimate” businesses. This is not unlike the Spam Provisions, which had a much broader reach than would be expected under the common conception of what spam is, as these provisions covered a wide range of “commercial electronic messages.”

The prohibition

Subject to specific exceptions (discussed below), CASL’s section 8 makes it illegal, in the course of a commercial activity, to install “computer software” (this term includes software, apps, etc.) on another person’s “computer system” absent express consent or, likely only rarely, a court order.
CASL uses the Criminal Code’s broad definition of computer system and this definition includes not only desktops and laptops, but also other systems such as a mobile device or a car’s computer system.
As with the Spam Provisions, businesses seeking consent to install “computer programs” need to clearly explain the purposes for which consent is sought and provide contact information (along with other information prescribed by regulations). In addition, businesses must also clearly and simply describe the function and purpose of the computer program to be installed if the consent is given.

Enhanced disclosure

The rule is also stricter when the to-be-installed computer program, contrary to the reasonable expectations of the user:

  • collects personal information;
  • interferes with the user’s control of the computer system;
  • changes the computer system’s settings without the user’s knowledge;
  • interrupts access to data stored on the computer system;
  • causes the computer system to communicate with other devices without user authorization; or
  • installs software that can be activated by another party without the knowledge of the computer system’s user.

As an illustration of computer programs that are subject to the enhanced disclosure requirements, one may think of a user that installs on his or her mobile device an app that he or she believes to be purely informational (an app that provides opening hours for a certain chain of stores, for example), without knowing the app in fact collects personal information and geolocation information about its users.
When a computer program is subject to this enhanced disclosure requirement, the person who seeks express consent to install such a computer program must, when requesting consent, describe these functions clearly and prominently and ensure such description is:

  • separate from the licence agreement; and
  • separate from any other information provided in the request for consent.

Moreover, for such computer programs, the person seeking consent must obtain acknowledgement in writing from the person from whom consent is being sought that he or she understands and agrees that the program performs the specified functions.

Exceptions

The following types of computer programs benefit from an “exception to consent requirement” when the user’s conduct is such that it is reasonable to believe he or she consents to the program’s installation:

  • Updates and upgrades, in limited cases, namely when (1) the person who gave the consent to the original installation is entitled to receive the update or upgrade under the terms of the original consent and (2) the update or upgrade is installed in accordance with those terms;
  • Programs that are routinely installed when a person uses a web browser (subject to the browser’s settings) to access websites including cookies, HTML and JavaScript code [2];
  • Operating software.

As more and more businesses (whether or not they see themselves as being in the business of distributing computer programs) that used to only operate “traditional” non-interactive websites try to move their users to websites or apps with enhanced functionalities, the new provisions are of interest for most B2C businesses, regardless of the nature of their core activities.
The enhanced disclosure provisions could be applicable more often than not considering that businesses often roll out apps specifically to collect data about their clients, whatever the app’s purpose is from the user’s point of view.
 


 
Footnotes
 
[1] An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act, SC 2010, c 23.
[2] The government has indicated in consultations that “Java Scripts” in the English version of the Act (as opposed to “JavaScript” in the French version) was a mistake. The English version should say “JavaScript.” Both expressions are not equivalent.

  • About
  • Latest Posts

Occasional Contributors

In addition to our regular guest bloggers, First Reference Talks blog published by First Reference, provides occasional guest post opportunities from various subject matter experts on the topics of human resources, employment/labour law, internal controls, information technology, not-for-profit, business, privacy, tax, finance and accounting, and accessibility in Canada among others. If you are a subject matter expert and would like to become an occasional blogger, please contact us. If you liked this post, subscribe to First Reference Talks blog to get regular updates.

Latest posts by Occasional Contributors (see all)

  • Genetic Non-Discrimination Act upheld by the Supreme Court: Implications for insurers - September 21, 2020
  • Let’s talk about assumptions and risk - September 11, 2020
  • Treat cyber as a business risk - August 31, 2020

Article by Occasional Contributors / Business, Information Technology, Privacy / Apps, B2C businesses, Canada’s anti-spam act, Canadian Radio-television and Telecommunications Commission Act, CASL, collects personal information, commercial activities, commercial electronic messages, Competition Act, computer software, cookies, criminal code, exception to consent requirement, express consent, html, Java Scripts, JavaScript, legitimate” businesses, licence agreement, malware, mobile device, Personal Information Protection and Electronic Documents Act, Request consent, software, Spam Provisions, Telecommunications Act, update or upgrade, viruses

Share with a friend or colleague

Learn the 10 essential HR policies in the time of COVID-19

Get the Latest Posts in your Inbox for Free!

About Occasional Contributors

In addition to our regular guest bloggers, First Reference Talks blog published by First Reference, provides occasional guest post opportunities from various subject matter experts on the topics of human resources, employment/labour law, internal controls, information technology, not-for-profit, business, privacy, tax, finance and accounting, and accessibility in Canada among others. If you are a subject matter expert and would like to become an occasional blogger, please contact us. If you liked this post, subscribe to First Reference Talks blog to get regular updates.

Footer

About us

Established in 1995, First Reference Inc. (known as La Référence in Quebec) provides Canadian organizations of any size with practical and authoritative resources to help ensure compliance.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2021 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy