Many readers of Focus will be familiar with Canada’s Anti-Spam Legislation (“CASL”), which came into force on July 1st, 2014. Among other things, the legislation regulates the sending of “Commercial Electronic Messages” or “CEMs”. Organizations that send “CEMs” should be aware of two important CASL updates. First, the implementation of the CASL provisions that would provide a “private right of action” for violations of the CASL has been delayed. These provisions were set to come into force on July 1, 2017, however, in response to concerns raised by a broad spectrum of stakeholders, the federal government postponed implementation earlier this month without setting a future date. Second, the CASL transition period relating to implied consent will end on July 1, 2017. This means that organizations that send CEMs based on an existing relationship must ensure that they obtain express consent from the recipients, or, if they wish to rely on implied consent, that the relationship with each recipient meets the requirements specified in the CASL, including the requirements relating to the time period in which the existing relationship was created.
“Private right of action” postponed
As noted above, the “private right of action” provisions of the CASL were scheduled to come into force on July 1st, 2017. These provisions would have enabled individuals and organizations to seek damages in civil court for violations of the CASL. Damages awarded would be based on the actual losses suffered, as well as statutory damages. Although in most cases the actual losses suffered by an individual who receives a spam e-mail will not be considerable, the statutory damages that may be available under the CASL are indeed significant. For example, the CASL damages that could be awarded against an organization for sending a contravening e-mail is set at $200.00 per occurrence, up to a maximum of $1 million per day. This statutory threshold combined with the possibility of class action lawsuits has given pause to many organizations that transmit CEMs.
As many readers of Focus will recall, sections 6 through 9 of the CASL set out various prohibitions relating to the sending of CEMs, as follows:
- section 6 prohibits the sending of a CEM unless the recipient consents to receiving the message, and the message provides the identity and contact information of the sender, as well as an unsubscribe mechanism.
- section 7 prohibits the “re-routing” of CEMs without the consent of either the sender of the re-routed message, or the ultimate recipient.
- section 8 prohibits the installing of a computer program that would cause CEMs to be sent unless the owner of the computer consents, and has the ability to remove or disable the program without cost.
- section 9 prohibits the aiding, inducing or procuring of any of the foregoing.
Other prohibitions that organizations should be cognizant of are section 74.011 of the Competition Act (Canada), which prohibits false or misleading advertising, and sections 5, 7.1(2) and 7.1(3) of PIPEDA, which operate to prohibit e-mail or personal information “harvesting”.
Should the private right of action provisions come into force in the future, the maximum amount of statutory damages that could be awarded for the various contraventions are as follows:
- section 6 of the CASL: $200 per violation up to a maximum of $1 million per day;
- sections 7 and 8 of the CASL: a maximum of $1 million per day for each day that a contravention occurred;
- section 9 of the CASL: a maximum of $1 million per contravention;
- section 5 of PIPEDA: a maximum of $1 million for each day that a contravention occurred; and
- section 74.011 of the Competition Act: $200 per contravention up to a maximum of $1 million per day.
It should be noted that the CASL does state that the purpose of any order for damages is to promote compliance with the CASL and not “to punish”. The legislation would also require courts to consider the following factors when determining the appropriate amount of statutory damages:
- the purpose of the order;
- the nature and scope of the contravention;
- the history of any previous contraventions and undertakings;
- any financial benefit the business obtained from the contravention;
- the offender’s ability to pay the total amount ordered;
- whether the applicant received compensation; and
- any other relevant factor.
Should the private right of action provisions become effective, organizations would be afforded a due diligence defence under the CASL. This means that a contravention will not be found where the organization can demonstrate that they exercised due diligence in order to prevent the breach. The due diligence defence is in addition to any defence that may be available at common law.
Transition period ending July 1, 2017
The other CASL update that organizations should be aware of relates to section 6 of the CASL and the prohibition against the sending of a CEM without the recipient’s consent. For the purposes of section 6, consent may be express or implied. For express consent, the sender of a CEM must obtain the recipient’s consent in a prescribed format. Implied consent on the other hand is defined to exist if the sender and receiver of a CEM have an existing business or non-business relationship. The CASL defines the terms “existing business relationship” and “existing non-business relationship” to capture situations in which the sender and receiver of a CEM have engaged in certain specified transactions, either commercial or non-commercial, within a specified period of time – usually two years.
The CASL transition period, which commenced on July 1, 2014, exempted existing business and non-business relationships from the specified time period necessary for implied consent. This meant that if an organization had established a business relationship with an individual at any time prior to 2014, and that relationship involved the sending of CEMs, the organization was permitted to continue sending CEMs during the transition period on the basis of implied consent. As the transition period is ending on July 1st of this year, organizations that send CEMs should ensure that they obtain express consent from recipients, or that their relationship with the recipient, whether business or non-business, meets the requirements of the implied consent provisions of the CASL, in particular with respect to the specified time period.
In our view
Given the significant exposure to class action lawsuits, as well as the significant statutory damages that could be awarded under the CASL, it is not surprising that organizations exerted considerable pressure on the government to delay the implementation of the private right of action provisions. At this point, it is unclear whether and when the private right of action provisions will become effective. Organizations that send CEMs may consider using this reprieve to make preparations to ensure compliance with the CASL. This would include ensuring that existing relationships, whether business or non-business, meet the requirements of the implied consent provisions by July 1st. Organizations may also consider reviewing any policies and procedures that relate to CEMs against the requirements of the CASL. Organizations may also use this time to ensure that employees are properly trained on CASL compliance.