sookman casl and universities

McCarthy Tétrault LLP / mccarthy.ca

Canada’s Anti-spam Law (CASL) and Universities

Barry B. SookmanDirect Line: (416) 601-7949E-Mail: [email protected]

September 27, 2013


CASL Purpose

¬ The purpose of CASL is to promote the efficiency and adaptability of the Canadian economy by regulating commercial conduct that discourages the use of electronic means to carry out commercial activities, because that conduct a) impairs the availability, reliability, efficiency and optimal use of

electronic means to carry out commercial activities; b) imposes additional costs on businesses and consumers; c) compromises privacy and the security of confidential

information; and d) undermines the confidence of Canadians in the use of

electronic means of communication to carry out their commercial activities in Canada and abroad. (s. 3)

2


Scope of CASL

¬ Anti-SPAM ¬ Anti-spyware/malware ¬ Amendments to PIPEDA prohibiting address

harvesting and personal information harvesting¬ Amendments to the Competition Act prohibiting

false or misleading representations in electronic messages, sender information in electronic messages, subject matter information in electronic messages, locaters

3


CASL History

¬ Received royal assent on December 15, 2010.¬ Original draft regulations were published in the summer of 2011

by the CRTC and Industry Canada. The Canadian business community raised serious objections to their strict requirements.

¬ The CRTC enacted revised regulations which were finalized on March 28, 2012.

¬ Revised draft regulations from Industry Canada on January 5, 2013. They were open for comment until February 4, 2013.

¬ CASL in force date?

4


Do Universities need to beconcerned about the anti-spam provisions in CASL?

5


CASL and Universities

¬ CASL does not exempt universities, charities, or non-profit organizations and will apply to many university activities that use electronic messages, including emails, newsletters, bulletins, advertisements, notices, social media.

¬ Areas for consideration include:¬ Admissions and Recruitment: advertising, promotions, and

communications with prospective students¬ Administration: communications with current students, goods

and service providers, university merchants, stakeholders ¬ Services to students e.g. housing, sports, booksore¬ Fundraising: dealing with alumni, student groups,

associations, foundations, marketing of co-branded products

6


Very High Liability

¬ Administrative monetary penalties (AMPS) with caps up $10 million for a university. (s.20(4))

¬ Private rights of action by anyone affected by a prohibited act (s.47(1)) with liability that consists of:¬ compensation for loss, damages and expenses; and ¬ extensive awards that are capped at:

¬ $1 million per day for breach of SPAM, malware, spyware, message routing, address and personal information harvesting, and Competition Act provisions;

¬ $1 million for each act of aiding, inducing, or procuring a breach of the SPAM, malware and spyware, and message routing provisions, plus liability up to $1 million per day for breach of SPAM, malware, spyware, and message routing provisions.

¬ Risk of class actions.

7


Extensive Accessorial and Vicarious Liability

¬ Liability extends to any person who aids, induces or procures a prohibited act. (s.9)

¬ Senders of CEMs are liable for acts of their employees within the scope of their authority. (s.32, s.53)

¬ Liability extends to officers, directors, and agents if they directed, authorized, assented to, acquiesced, or participated in the prohibited act. (s.31, s.52)

¬ Risk implications for universities e.g., too easy to pierce corporate veil; requirements for insurance?

¬ Does the risk make sense for universities, charities and not for profit enterprises (or any other entity)?

8


AUCC submission to Industry Canada:“Canadian universities are concerned…that the law's blanket prohibition against sending commercial electronic messages without express or implied consent of the recipient may capture and inhibit electronic communications by universities which are part of their core educational activities. These activities are not the intended target of the legislation, and could potentially result in new administrative burdens, financial penalties, and damage to institutional reputations.”

What does AUCC think about CASL?

9


AUCC submission to Industry Canada“The significant penalties that may apply to individuals and organizations that do not comply with the terms of the Act — up to $1 million for an individual and up to $10 million for an organization for each violation of the Act — are also of great concern. These concerns are magnified by the possibility of vicarious liability for the officers and directors of an organization for a violation of the Act, as well as the new private right of action for individuals who receive commercial electronic messages without their consent, which could lead to a class action lawsuit by individuals receiving unsolicited "commercial electronic messages”.”


10


AUCC submission to Industry Canada:“AUCC recommends that Industry Canada amend the draft Electronic Commerce Protection Regulations to exempt registered charities, including universities, from the requirement to have the express or implied consent of recipients prior to the sending of "commercial electronic messages."


11


Imagine Canada submission to Industry Canada:“Legislation and regulations aimed at controlling spam in Canada should not be so overly broad in scope that they impede and make more costly the electronic communications of registered charities, including universities, for purposes such as fundraising. The Canadian Radio-television and Telecommunications Commission's Unsolicited Telecommunications Rules that are intended to control a related problem — telemarketing — reflect this principle by exempting from the application of the National Do Not Call List Rules any unsolicited telecommunications made by or on behalf of a registered charity.”

What do charities think about CASL?

12


Imagine Canada submission to Industry Canada1.The definition of “commercial electronic message” is sufficiently broad that it will restrict the ability of many charities and public-benefit nonprofits to carry out activities that further their missions to serve Canadians and communities. 2.The draft regulations, as presented, would place undue financial and administrative burdens on charities and public-benefit nonprofits. 3.The draft regulations do not reflect or accommodate the ways in which charities and public benefit nonprofits communicate with each other, with key stakeholders, or with the general public.4.The draft regulations are inconsistent with other domestic policies and with the federal government’s stated objectives regarding philanthropy and the facilitation of earned income by charities and public-benefit nonprofits.5.The draft regulations are inconsistent with policy developments internationally.

What do charities think about CASL?

13


Ontario Nonprofit Network submission to Industry Canada:“Small and mid-size charitable and nonprofit organizations cannot comply with CASL and its regulations and undertake their day-to-day work. There is a fundamental conflict that will either impede their work in communities or, as noncompliant, leave them vulnerable to potentially prohibitive fines and private actions.The legislation and regulation will place undue financial and administrative burden on those nonprofit organizations which attempt to comply.The prohibitive costs and risks associated with requiring that charities and nonprofit organizations manage and maintain express and implied consent records across their complex databases and ever-changing community connections and relationships is not justified given their negligible participation in the generation of spam.”

What do not-for profits think about CASL?

14


Coalition of Business and Technology Associations submission to Industry Canada:¬“We have now been working with CASL for over two years and have a better appreciation of the compliance challenges and the potential for unintended consequences resulting from CASL‟s regulatory approach much more than we did when CASL was passed by Parliament. The inclusion in CASL of both open ended prohibitions and prescriptive requirements makes it very difficult to anticipate all of the impacts that CASL will have. We are now more concerned than ever that CASL will actually result in more harm than benefit to the Canadian economy and to digital commerce. We are also concerned that the harm will be exacerbated by the potential for litigation under the private rights of action.”

What do businesses think about CASL?

15


Anti-SPAM provisions and regulations

16


The Anti-SPAM Prohibition:Consent, Form and Content

S.6(1) It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless:

a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and

b) the message complies with subsection (2).(2) The electronic messages must be in a form that conforms to the prescribed requirements and must:

a) set out prescribed information that identifies the person who sent the message;

b) set out information enabling the person to whom the message is sent to readily contact the sender; and

c) set out the prescribed unsubscribe mechanism.

17


What Messaging Systems are Covered

¬ “electronic message” means a message sent by any means of telecommunication, including a text, sound, voice or image message. (s1(1)) (But, excludes interactive two-way voice communication between individuals, fax messages to a telephone account, voice recordings to a telephone account. (s.6(8))

¬ “electronic address” means an address used in connection with the transmission of an electronic message to (a) an electronic mail account; (b) an instant messaging account; (c) a telephone account; or (d) any similar account. (s.1(1))

¬ Covers opt-in closed messaging systems e.g., instant messaging, online portals, SMS, electronic alerts, and other messaging systems and methods.

18


What is a CEM?

A “commercial activity” is any particular transaction, act or conduct or any regular course of conduct that is of a commercial character whether or not the person who carries it out does so in the expectation of profit, other than any transaction, act or conduct that is carried out for the purposes of law enforcement, public safety, the protection of Canada, the conduct of international affairs of the defence of Canada” (s.1(1)).

19


What is a CEM?

A “commercial electronic message” is an electronic message that, having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity, including an electronic message that (a) offers to purchase, sell, barter or lease a product, goods, a service, land or an interest or right in land; (b) offers to provide a business, investment or gaming opportunity; (c) advertises or promotes anything referred to in paragraph (a) or (b); or (d) promotes a person, including the public image of a person, as being a person who does anything referred to in any of paragraphs (a) to (c), or who intends to do so. (s.1(2))

20


Is the definition of CEM too broad?

¬ Promoting upcoming events including concerts, plays, sporting events, and/or any other student events where there is an admission charge

¬ Offering goods or services for which there is a charge (including sales at the book store, or promotional material for on campus merchants)

¬ Fundraising requests including the solicitation of participation in charity drives or sponsored events

¬ Student communications concerning tuition, housing, parking, food services, fees for activities

¬ Promotion of third party commercial activities e.g., credit cards for students or alumni

¬ Student recruitment ¬ Promotion of new courses to prospective students¬ Promote sponsorship opportunities for corporations¬ Messages sent by university clubs to prospective members where there is

a cost for joining or for an event

21


AUCC submission to Industry Canada“Communications relating to core university activities, including the recruitment of students, the delivery of academic programs, and communications with alumni and potential donors are not activities of a commercial character that should be caught by anti-spam legislation…However, the broad wording of the term "commercial activity" in the Act creates uncertainty about whether some electronic communications by universities in furtherance of educational objectives will be treated as "commercial activities" and spam.”


22


AUCC submission to Industry Canada“Given the uncertainty about whether the recruitment of students is a "commercial activity" for the purposes of the Act, and that the onus rests with the sender of a "commercial electronic message" to prove that consent existed at the time a message was sent, a university that wishes to take a prudent approach would be reluctant to send an electronic message to prospective Aboriginal students or leaders without their prior consent or to send a message to obtain that consent since that message itself may constitute a violation of the Act. This could impede the recruitment of aboriginal students by universities.”


23


Some messages that might not be CEMs may be treated as CEMs to which the form and unsubscribe provisions apply. For example:The consent requirement does not apply to a CEM that solely (s.6(6)): ¬provides a quote or estimate... if the quote or estimate was requested;¬facilitates, completes or confirms a commercial transaction; ¬provides warranty information, product recall information or safety or security information about a product, goods or a service; ¬provides notification of factual information about (i) the ongoing subscription or use or ongoing purchase by the person to whom the message is sent of a product, goods or a service offered under a subscription, membership, account, loan or similar relationship; ¬provides information directly related to an employment relationship or related benefit plan;¬delivers a product, goods or a service, including product updates or upgrades, that the recipient is entitled to receive under the terms of a transaction...


24


General ExceptionsConsent, Form and Content Exceptions

¬ Where sender and recipient have a personal or family relationship (s.6(5)(a))¬ An inquiry or application related to a person engaged in a commercial activity.

(s.6(5)(b))¬ Messages sent in response to requests, inquiries or complaints (Draft IC Regs -

3(b))¬ Messages sent due to a legal obligation or to enforce a legal right including a

pending legal right (Draft IC Regs - 3(d))¬ Messages sent within an organization that concern the business affairs of that

organization (Draft IC Regs - 3(a)(i)).¬ Messages sent between organizations with a business relationship that concern

the recipient’s business, role, functions or duties (Draft IC Regs - 3(a)(ii)).¬ Messages sent by a foreign organization to a foreign recipient that is accessed

while roaming in Canada (Draft IC Regs – 3(c))NOTE: Draft IC Regulations are subject to comment and finalization. Accordingly, the

above noted exceptions from the Draft IC regulations may change in response individual and organizational feedback.

25


Getting Express Consents to Send CEMs

Express consents must be:i. obtained orally or in writing for a particular

purpose ii. clearly and simply set out prescribed form and

content information including the name of the requester, the purpose of the request, the mailing address, email or website of the requester; and

iii. be sought separately for each act described in the Act (sending of messages, alteration of transmission data, installation of a computer programs)

26


Getting Express Consents to Send CEMss.6 of the Act and s. 4 of the CRTC Regs

Prescribed Requirements:

a) the purpose or purposes for which the consent is being sought;

b) the name by which the person seeking consent carries on business, if different from their name, if not, the name of the person seeking consent;

c) if the consent is sought on behalf of another person, (i) the name by which the person on whose behalf consent is sought carries on business, if different from their name, if not, the name of the person on whose behalf consent is sought; and (ii) a statement indicating which person is seeking consent and for which person consent is sought;

d) the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address of the person seeking consent or, if different, the person on whose behalf consent is sought; and

e) a statement indicating that the person whose consent is sought can withdraw their consent.

27


Implied ConsentsImplied (expires after an initial period – often 2 years): Based on a closed list of categories:

i. where there is an ‘existing business relationship’ or an ‘existing non-business relationship.’

ii. where the recipient has “conspicuously published” the electronic address without a statement that the person does not wish to receive unsolicited CEMs AND the message is relevant to the person’s business, role, functions or duties in a business or official capacity;

iii. where the recipient has disclosed, to the person who sends the message, the electronic address without indicating a wish not to receive unsolicited CEMs, AND the message is relevant to the person’s business, role, functions or duties in a business or official capacity;

Do the exceptions apply to universities?

28


Existing Business Relationship“Existing business relationship” is a business relationship arising from (s.10(10)):

a) the purchase or lease of a product, goods, a service, land or an interest or right in land, within the 2-year period immediately before the day on which the message was sent;

b) the bartering of anything mentioned in paragraph (a)...c) a written contract entered into between the recipient and the sender in

respect of a matter not referred to in any of paragraphs (a) to (c), if the contract is currently in existence or expired within the period referred to in paragraph (a); or

d) an inquiry or application, within the 6-month period immediately before the day on which the message was sent, made by the recipient to the sender, in respect of anything mentioned in any of paragraphs (a) to (c).

Can universities rely on this exception?

29


Existing Non-Business Relationship

“Existing non-business relationship” is a non-business relationship arising from (s.10(13)):

a) a donation or gift made by recipient to the sender within the 2-year period immediately before the day on which the message was sent, where the sender is a registered charity, a political party or organization, or a person who is a candidate for publicly elected office;

b) volunteer work performed by the recipient for the sender, or attendance at a meeting organized by the sender, within the 2-year period immediately before the day on which the message was sent, where the sender is a registered charity, a political party or organization, or a person who is a candidate for publicly elected office; or

c) membership, as defined in the regulations, by the recipient, in the sender, within the 2-year period immediately before the day on which the message was sent, where the sender is a club, association or voluntary organization, as defined in the regulations.

30


AUCC Submission to Industry Canada:“The Act provides that consent to receive commercial electronic messages may be implied where there is an existing business relationship or existing non-business relationship with a message recipient. There are, however, many circumstances in which the relationships the university has or wishes to establish may not qualify for implied consent because they do not meet the narrow conditions set out in the Act.”

What does the AUCC think about the “implied exceptions”?

31


AUCC Submission to Industry Canada:“Under the Act, consent is implied where there is an "existing non-business relationship". Under section 10(13)(a) of the Act, a consent to communicate electronically for the purpose of soliciting charitable donations will be implied only if the recipient of the message has donated to a charity within the two-year period preceding the date on which a charity sends the electronic message. Past donors may choose to defer making further charitable donations for extended periods of time when there are prolonged downturns in the financial markets and economy. The imposition of an arbitrary two-year window for communications with these past donors would make future contact more difficult and costly if organizations are required to turn to telephone solicitation or mail to reach them. Moreover, the "existing non-business relationship" exemption does not apply to individuals who have never donated to an organization in the past but may be open to doing so if contacted.”

What does the AUCC think about the “implied exceptions”?

32


Canadian Bar Association submission to Industry Canada¬“This limited definition of a non-business relationship will exclude many relationships within the charity and NPO sector. The relationships of organizations with a focus on education, medical care, research collaboration and public affairs, for example, may not be based on donations and gifts, volunteer work or the definition of “club, association or voluntary association” included in the Regulations, and in those circumstances they may not be entitled to implied consent. It seems to be an inadvertent consequence of the legislation that charities and NPOs be placed at a disadvantage compared to businesses on the requirement to obtain express consents for electronic communications. This unnecessary new layer of administration will be a drain on the limited resources of charities and NPOs and will impede their good works.”¬“It is critical that the uncertainty about application of the Act to the electronic communications of charities and NPOs be resolved before the Regulations come into force. Otherwise, charities and NPOs will be faced with the monumental task, with limited resources, of seeking consent for many of its electronic communications without a clear understanding of whether it is required.”

What does the CBA think about the “implied exceptions”?

33


A person’s consent to receiving commercial electronic messages from another person is implied until:

1. the person gives notification that they no longer consent to receiving such messages; or

2. 3 years after the day on which the Act comes into force, if (a) those persons have an existing business relationship or an existing non-business relationship; and (b) the relationship includes the communication between them of commercial electronic messages. (s. 66)

Problems: Universities must determine if they have express consent or the

requisite EBR or ENBR to avail themselves of these transitional provisions.

Transitional provisions

34


Canadian Bar Association“The CBA Sections reiterate the concern expressed in our previous submission on the vitiation of prior express consents valid under federal, provincial or territorial legislation. There does not appear to be a policy rationale for undermining the good faith effort by organizations to obtain legally valid consents prior to the Act coming into force. Recontacting consumers for consent already provided and automatic expiry of consent after a transition period will likely create confusion among consumers and undermine confidence in electronic commerce, contrary to the legislative objective. The CBA Sections recommend an additional regulation stating that a valid consent given under PIPEDA or other privacy legislation prior to the Act coming into force be deemed a valid consent under the Act.”

What does the CBA think about the transitional provisions?

35


Philip Palmer (Formerly of Industry Canada)“No benefit to consumers is gained by restricting the transition period to implied consents through the existing business relationship. There is no reason why existing business relationships should be favoured over other forms of implied consent.The failure to act on the inequitable disparity between existing business relationships and other types of implied consent serves no discernible purpose and imposes unjustifiable compliance costs on business.”

Do the transitional provisions make policy sense?

36


AUCC submission to Industry Canada:“A blanket exemption for the charitable sector is the most efficient approach to ensuring that charities are not harmed by anti-spam legislation. The alternative would be to enumerate a detailed list of specific exemptions. The piecemeal approach will inevitably result in gaps in coverage. The Australian law cited above, for example, also exempts electronic messages sent by an educational institution to students and former students of the institution, or to members of their households, but this exemption is inadequate because it fails to cover electronic communications for core university activities such as student recruitment or fundraising.”

What should be done for universities?

37


AUCC submission to Industry Canada:“AUCC recommends that Industry Canada should use the regulatory powers granted in section 6(5)(c) of the Act to provide exceptions for electronic communication "that is of a class, or is sent in circumstances, specified in the regulations," and specifically to amend the draft Electronic Commerce Protection Regulations to exempt registered charities, including universities, from the requirement to have the express or implied consent of recipients prior to the sending of "commercial electronic messages”.”


38


AUCC submission to Industry Canada:“Should Industry Canada decide not to exempt charities from the requirements of the Canadian Anti-Spam Legislation, AUCC recommends that section 3 of the Electronic Commerce Protection Regulations be amended by the addition of a new subsection 3(e) which would read as follows:¬that is sent by or on behalf of a not-for-profit educational institution to any of the following persons,¬a person who is, or has been, enrolled as a student in that institution;¬a member or former member of the household of a person who is, or has been, enrolled as a student in that institution;¬a person who is a prospective student of an educational institution; or¬a person from whom an educational institution solicits a charitable donation, or to whom an educational institution sends an invitation to participate in a fundraising event.”


39


Steps to be taken before CASL becomes effective. 1. Due diligence defense.2. Assign or delegate a centralized resource to manage compliance?3. Conduct a review/survey of each department, to identify current

communications (or software installation) practices, disclosures, methods of obtaining consent and unsubscribe techniques?

4. Analyze data and assess sufficiency of current practices, do you have express consents or does it fall into exceptions?

5. Develop a plan to address GAPS, establish policies and procedures to ensure ongoing compliance and institutionalize the monitoring of CASL activities?

6. Start getting express consents ASAP?7. McCarthy Tetrault Toolkit.

Compliance Steps

40


¬ Canada’s anti-spam law, too much of a good thing ¬ Evaluating the Industry Canada CASL regulations: my

submission to the consultation ¬ CASL flaws not Festivus grievances¬ CRTC Issues CASL (Canada’s Anti-Spam Law)¬ Reflections on the new CRTC CASL regulations¬ McCarthy Tetrault CASL Toolkit

Other readings

41


VANCOUVERSuite 1300, 777 Dunsmuir StreetP.O. Box 10424, Pacific CentreVancouver BC V7Y 1K2Tel: 604-643-7100 Fax: 604-643-7900 Toll-Free: 1-877-244-7711

CALGARYSuite 3300, 421 7th Avenue SWCalgary AB T2P 4K9Tel: 403-260-3500 Fax: 403-260-3501 Toll-Free: 1-877-244-7711

TORONTOBox 48, Suite 5300Toronto Dominion TowerToronto ON M5K 1E6Tel: 416-362-1812 Fax: 416-868-0673 Toll-Free: 1-877-244-7711

MONTRÉALSuite 25001000 De La Gauchetière Street WestMontréal QC H3B 0A2Tel: 514-397-4100 Fax: 514-875-6246 Toll-Free: 1-877-244-7711

QUÉBECLe Complexe St-Amable1150, rue de Claire-Fontaine, 7e étageQuébec QC G1R 5G4Tel: 418-521-3000 Fax: 418-521-3099 Toll-Free: 1-877-244-7711

UNITED KINGDOM & EUROPE125 Old Broad Street, 26th FloorLondon EC2N 1ARUNITED KINGDOMTel: +44 (0)20 7786 5700 Fax: +44 (0)20 7786 5702

42

sookman casl and universities

Technology

publicly elected

draft ic regs

place undue

year period

ca aucc submission

draft ic regulations

business relationship

receive unsolicited