After three years of waiting, Industry Canada has finalized the Electronic Commerce Protection Regulations and set a date for Canada’s anti-spam legislation to come into force. An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, commonly called the Fighting Internet and Wireless Spam Act or simply “Canada’s Anti-Spam Legislation” (CASL) will be phased in over four years starting July 1, 2014—seven short months from now.
Most of the law and its regulations will take effect in July, specifically sections 1–7, 9–46, 52–54, 56–67 and 69–82 of the Act, subsections 12(2) and 12.2(2) of the Personal Information Protection and Electronic Documents Act, as enacted by section 83 of the anti-spam law, subsection 86(2), section 88 and subsection 89(1) of the Act.
Section 8 comes into force on January 15, 2015. The section prohibits an organization from installing a computer program on a user’s computer or device or sending messages from a user’s device without authorization.
Sections 47–51 and 55 come into force on July 1, 2017. These provisions describe the private right of action that the law confers on parties affected by contraventions of the anti-spam law.
Industry Canada has modified the Regulations from their earlier versions in order to balance the needs of businesses and the security and privacy of parties that receive commercial electronic messages (CEMs). “Since it applies broadly to all commercial electronic messages,” says Industry Canada, “the Act could capture a significant portion of business-to-business communications.” To avoid this outcome, the Act permits the government to exclude types of commercial electronic messages that are better left unregulated. Initially, the Regulations exempt messages that are:
- Sent within an organization
- Sent between organizations that already have a relationship, where the message concerns the activities of the organization to which the message is sent
- Sent on platforms where the required identification and unsubscribe information is conspicuously published and readily available to the recipient on the user interface, where duplication in each message would be needlessly repetitious
- Sent and received within limited access secure and confidential accounts to which only the provider of the account can send messages, such as banking websites
- Solicited or sent in response to complaints, inquiries and requests
- Sent due to a legal or juridical obligation or to enforce a right, legal or juridical obligation, court order, judgment or tariff; to provide notice of an existing or pending right, legal or juridical obligation, court order, judgment or tariff; or to enforce a right arising under a law of Canada, of a province or municipality of Canada, or of a foreign state
- Sent by or on behalf of registered charities for fundraising purposes
- Sent by or on behalf of a political party or organization, or a person who is a candidate—as defined in an Act of Parliament or the legislature of a province—for publicly elected office and the message has as its primary purpose soliciting a contribution as defined in subsection 2(1) of the Canada Elections Act
Industry Canada still expects to address concerns with the law and its Regulations by way of compliance guidelines, some of which are included in the Regulatory Impact Analysis Statement. For instance, Industry Canada notes that:
Only persons who play a material role in the content of the message or the list to whom the message is sent are required to be identified as ‘senders’ or ‘affiliates’ under section 6 of CASL. However, when a CEM is sent on behalf of multiple persons, such as affiliates, all of these persons must be identified in a CEM. Where it is not practicable to include this information in the body of a CEM, a hyperlink to a page on the World Wide Web containing this information that is readily accessible at no cost to the recipient may be included in the CEM.
An interesting exception applies to certain social networking and instant messaging services. Industry Canada notes:
Where they are not sent to electronic addresses [including instant messaging and social network accounts], the publication of blog posts or other publications on microblogging and social media sites does not fall within the intended scope of the Act.
In other words, a party may indiscriminately publish commercial messages via its social media accounts (e.g., Facebook, Twitter, LinkedIn, blogs, etc.) without falling afoul of the anti-spam law. Presumably this is because a person usually chooses (i.e., gives consent) to view another party’s social media or blog postings.
Many—indeed, most—businesses will be affected by this law and its Regulations, and it is crucial to understand what it will mean for your organization and how you communicate. Jeffrey Sherman outlined the new legal obligations last year in his blog post “What do I need to know about Canada’s new anti-spam legislation?” The Industry Canada Regulatory Impact Analysis Statement is another good place to find information. I discussed how organizations can start to get ready in January. A compliance plan and checklist will certainly help.
Adam Gorley
First Reference Internal Controls and Compliance Editor
 |
Finance and Accounting PolicyProFinance and Accounting PolicyPro (FAPP), published by First Reference, has been updated to reflect the new requirements imposed by the law. Chapter 6 of the Operations and Marketing volume of FAPP covers the anti-spam requirements, plans research and strategy, advertising and direct marketing, and much more. Take a free trial today!
|
