Canada’s Anti-Spam Legislation (“CASL”), which came into force on 1 July 2014, is considered by some experts to be one of the most onerous anti-spam/anti-malware laws in the world. On 1 July 2017, it will become even more onerous when the private right of action (“PRA”) comes into force.
The PRA is expected to increase the number of claims (including class proceedings) made under CASL. Insurers will need to factor the PRA into the underwriting of many policies issued in the future.
Below is an overview of CASL, a summary of the PRA, and comments about some of the ways in which the PRA could affect the Canadian insurance market.
The Purpose of CASL
One of the primary goals of CASL is to protect Canadians from receiving unsolicited commercial electronic messages (“CEMs”) and unsolicited computer programs or software on their electronic devices.
CEMs are private messages including emails, SMS text messages, instant messages, and private messages on social networking accounts, which encourage participation in a commercial activity. CASL prohibits the delivery of such messages without the recipient’s consent.
Consent may be implied in the context of an existing business relationship, subject to certain criteria and qualifications. In all cases, however, CEMs must, at a minimum, clearly identify the sender, include the sender’s mailing address, and contain an ‘unsubscribe’ option.
CASL also prohibits the installation of computer programs without the express consent of the owner of the electronic device. This applies when the device is located in Canada, or when the installer is located in Canada. There are exceptions to this rule, such as if the sender obtains a court order requiring the installation of the program, or where it is reasonable to believe that the owner consented to the program’s installation (e.g. cookies or Java Scripts).
The Canadian Radio-television and Telecommunications Commission (“CRTC”) responds to the above-noted CASL violations via consumer complaints. Individual violators may be liable for up to $1 million per complaint, while businesses may be liable for up to $10 million per complaint. Additionally, directors, officers or agents of a company may be held personally liable if they directed, authorized, assented or acquiesced to, or participated in, the commission of the violation, subject to a “due diligence” defence.
What is the PRA?
The PRA (sections 47-51 of CASL) permits an individual or organization to commence a private action against those who allegedly violated certain CASL provisions. Furthermore, offending directors, officers or agents of organizations can be held jointly and severally liable for these alleged violations (subject to a due-diligence defence) if they directed, authorized, assented or acquiesced to, or participated in, the alleged violation, irrespective of whether the organization is sued.
The private right of action allows a plaintiff to sue for actual and statutory damages. Actual damages are intended to compensate an aggrieved party for breach of his/her rights. A plaintiff is also entitled to sue for statutory damages unless the alleged violator(s) provided the CRTC with an undertaking to pay a fine and/or undertake certain corrective measures, or has already been served with a notice of violation by the CRTC, in respect of the same alleged conduct.
Statutory damages could prove to be quite onerous. Anti-spam violations may result in an award of $200 per violation, up to $1 million per day. For instance, if a company sends out 1,000 emails per day to its customers, advertising for its annual holiday sale, for a period of 30 days prior to Christmas, and those emails do not comply with the relevant provisions of CASL, the company, as well as its directors, officers and agents may be jointly and severally liable for $3 million in statutory damages, in addition to compensatory damages.
How the PRA might affect Insurers in Canada
The PRA will probably affect insurers who issue Cyber / Privacy Liability policies in Canada, to the extent that they would cover third-party claims arising out of privacy violations. Violations of CASL and privacy laws are often intertwined. This is underscored by the fact that the Office of the Privacy Commissioner of Canada is responsible for enforcing certain CASL violations.
Insurers who issue Directors’ and Officers’ Liability policies should also be concerned. D&O policies that do not expressly exclude marketing or privacy violations could be exposed to claims under the PRA because of the exposure to directors and officers. Additionally, insureds could attempt to seek coverage under the Personal/Advertising Injury section of CGL policies. Insurers who do not expressly exclude these sorts of claims could face exposure to significant defence costs.
There is also the issue of whether statutory damages would be excluded as fines or penalties. This, of course, would depend on the wording of the particular policy. As articulated in section 51(1)(b) of CASL, they are not expressly called fines or penalties. In fact, while section 51(1)(a) refers to “compensation” (i.e. compensatory damages), section 51(1)(b) does not denote statutory damages by any name; it simply describes the maximum amounts that could be owed. Therefore, insurers could have difficulty successfully arguing that they do not owe indemnity for such amounts.
Moreover, insurers underwriting these risks in Canada should be concerned about the PRA providing a further avenue for class action litigation. Privacy class actions are already on the rise in Canada, especially with recent court decisions affirming common law privacy rights. The PRA is likely to result in the continuation of this trend, as CASL relates to both marketing and privacy law, which would mean further litigation costs incurred by insureds, and, therefore, insurers potentially covering such defence costs. While some refer to class action litigation as a licence to print money, it can often become, for insureds and insurers, a licence to burn money. That is why it is important to be very wary of CASL and the PRA now, before underwriting any further policies in Canada for which such claims may trigger coverage.