Ranking fifth in the world behind Iran, Nigeria, Kenya, and Israel, Canada has gained a reputation as a leading source of web-based email spam. The recent decision by a California court, awarding the social networking website, Facebook, with US$873 million in damages for the spamming activities of a Montreal-based organization, grabbed headlines and highlighted Canada’s less-than-adequate legislation in the fight against spam. In 2007, online sales in Canada reached $62.7 billion. It is projected that electronic commerce worldwide will exceed $8.75 trillion in 2009. Consequently, it is of no surprise that the Canadian Government is finally taking action to implement anti-spam legislation equivalent to the laws of other industrialized countries.
Bill C-27, the Electronic Commerce Protection Act (ECPA), was tabled in Parliament on April 24, 2009, and has recently passed its second reading in the House of Commons. The bill is now at the level of the Committee of Industry, Science and Technology. A similar bill was tabled in the Senate by Senator Yoine Goldstein, Bill S-220, on February 3, 2009, which has also passed its second reading by the Senate and is now referred to the same Committee. Focus of this bulletin will be on Bill C-27 as bills introduced in Parliament tend to have a greater likelihood of passage than those introduced in the Senate.
The proposed ECPA is intended to drive spammers out of Canada and deter the most dangerous forms of spam, such as identity theft, phishing, and spyware. Phishing, for instance, involves email solicitation of an unsuspecting victim, who receives an email containing a link to a counterfeit website in an effort to obtain personal information. Spyware is software installed on a personal computer, unbeknownst to the owner, that collects personal information and the browsing habits of the unsuspecting user. Bill C-27 also allows businesses and consumers to have a civil right of action to file lawsuits against Canadian-based spammers in violation of the provisions of the ECPA, and/or the new provisions of the Competition Act or the Personal Information Protection and Electronic Documents Act (“PIPEDA”).
The language of the ECPA is technologyneutral, treating all forms of commercial electronic messages with the same approach. Therefore, unsolicited text messages, known as “cellphone spam”, can also be treated as “unsolicited commercial electronic messages”; and hence would be subject to the penalties of the proposed legislation. The bill also requires that all senders obtain express consent before sending commercial electronic messages, and to include contact information and instructions on how to unsubscribe.
Interestingly, the bill sets up a tri-enforcement regime involving the Canadian Radio-television and Telecommunications Commission (“CRTC”), the Competition Bureau and the Office of the Privacy Commissioner (“OPC”). The three bodies are given the power to exchange information and evidence with their international counterparts that enforce similar laws in an effort to address the coordinated efforts of spammers.
In accordance with the proposed legislation, the CRTC would have a broad range of investigatory and ameliorative powers. Under its ECPA role, the CRTC would have the power to require ISPs to preserve transmission data during an investigation. The Commission could also require individuals to produce documents, as well as obtain warrants to conduct searches for evidence of a possible violation.
Once an investigation has been completed and there is evidence of a violation, the CRTC would have the option to choose between two courses of action. The first option would be to obtain an “undertaking”, which is essentially a settlement between the CRTC and the alleged spammer. An undertaking would include the past violations of the individual and would set out a penalty and any additional conditions.
The second course of action in the proposed legislation that the Commission could follow would be to file a “notice of violation”, which is a more lengthy process. After filing a notice of violation, the CRTC would have three years to commence an action against the alleged spammer. If an action is commenced, the accused spammer is served with the notice, and is then given the opportunity to defend his or her actions by submitting representations to the CRTC. The Commission would then decide, on a balance of probabilities, whether a violation of the ECPA occurred. Decisions by the Commission could be appealed to the Federal Court of Appeal.
Under the proposed ECPA, the CRTC would also have the right to publicly name individuals involved in the undertaking process or those who have violated the law. Corporate officers and directors could also be held liable for the violations committed by their companies.
With respect to penalties, the proposed ECPA would enable the CRTC to impose administrative monetary penalties (AMPS) of up to $1 million for individuals and $10 million for all other offenders. Related amendments to the Competition Act would expressly extend its dual-track criminal and civil prohibitions against making materially false and misleading representations in respect of the supply or use of products to representations contained in electronic messages. Fines at the discretion of the court and, in the case of individuals, imprisonment for up to 14 years are provided in the event of criminal conviction. On the civil side, any court in imposing an AMP for persons engaging in making false or misleading representations that only constitute reviewable conduct would be required to take into consideration any amounts ordered or agreed to be paid under the ECPA. Lastly, a civil right of action for any person suffering loss or damage as a result of such criminal activity would exist under section 36 of the Competition Act. The OPC would not have power to impose AMPS, but would be able to utilize its existing tools and enforcement framework to enforce the provisions of the ECPA. The bill goes further to propose that the Privacy Commissioner’s powers to exchange information with international counterparts be expanded.
Industry Canada would also have the additional duty to undertake the role of “national coordinating body”, with a mandate to conduct research, gather intelligence, and increase the education and awareness of consumers, network operators, and the private sector of the ECPA. There are also plans to establish a Spam Reporting Centre that would send and receive reports of spam and related threats in an effort to coordinate and inform the three enforcement agencies.
As briefly mentioned, a defining aspect of the ECPA is that an electronic commercial message cannot be sent to a recipient without their consent. Generally, consent must be express; however, consent may be implied depending on whether there is an existing business relationship between the sender and the recipient. A similar exception is found in the national Do-Not-Call list, which was launched by the federal government in September 2008. The Do- Not-Call list, as created by the Telecommunications Act, is a national registry of Canadian consumers, who have opted to be on the list that prohibits businesses from soliciting them by telephone. There has been some speculation that the last provisions of the proposed ECPA would put an end to the Do-Not- Call list by repealing the relevant sections of the Telecommunication Act. However, recent comments made by Conservative MP Terence Young during the debates at the second reading of the bill have assured otherwise.
Modelled on U.S. legislation, the bill would establish a clear regulatory approach consistent with international best practices. Canada is the last G8 country to pass anti-spam legislation. Many consider Bill C-27 to be long overdue in alleviating Canada from its reputation as a spam safe haven. Government consultations with consumers, Internet service providers, businesses, the financial sector, legal and consumer groups, and enforcement agencies show significant support for the ECPA. While there are several steps and hurdles to pass before royal assent can be achieved, passing Bill C- 27 into law will finally enable Canada to contribute to the organized effort against spam.
