The Canadian Radio-television and Telecommunications Commission has released the first instalments in a series of information bulletins intended to clarify the requirements of Canada’s anti-spam legislation and associated regulations.
The legislation, which was enacted in December 2010, is expected to be proclaimed in force in 2013. Earlier this year, the CRTC released accompanying Electronic Commerce Protection Regulations, which set out the form and content of information to be included in commercial electronic messages (CEMs) regulated by the legislation.
The information bulletins released on October 10, 2012, clarify several aspects of the Regulations, most notably the express consent and unsubscribe requirements as they relate to sending CEMs, installing programs on a user’s computer and altering transmission data in electronic messages (referred to as "regulated actions" in Torys’ bulletin). The clarifications will assist businesses in preparing their electronic communication templates, online privacy options and record-keeping practices to comply with the legislation, though more regulations are expected to be published before the law comes into force.
Clarification of Express Consent Requirements
The CRTC information bulletins state that
- express consent may be obtained by separate tick-boxes or icons for each regulated action provided that consent is not assumed by way of pre-ticked box or icon ("toggling"); opt-out consent will not be sufficient under the Act;
- express consent cannot be subsumed in or bundled with general condition of use or sale of a commercial product or service;
- consent must be sought and obtained separately for each regulated action (to ensure that a person is free to accept or reject the request for consent to each regulated action independent from any other);
- requests for consent must note that the user can withdraw his or her consent at any time. The CRTC further noted in information bulletin 2012-549 that confirmation of receipt of express consent should be sent to users who opt in to any regulated action;
- express consent may be obtained orally or in writing, but the onus of proof that it has been obtained falls on the person engaged in the regulated action. That onus can be met for oral consent where it can be verified by an independent third party or an audio recording. Written consent can be obtained in paper or electronic form, including by entry in a database that records date, time, manner of and purpose of the consent.
Clarification of Unsubscribe Mechanisms
The Regulations require that an unsubscribe mechanism that can be readily performed be clearly set out in any CEM. Examples of simple and quick unsubscribe mechanisms provided by the CRTC include a web address in an email that hyperlinks to a page on which the user can unsubscribe from all or some types of CEMs from the sender. The CRTC recommends that CEMs sent by text message offer the choice between replying "STOP" or "Unsubscribe" to the message, or clicking on a link to an unsubscribe webpage.
Users who consent to a regulated action that involves installing a program on their computers must be provided with the option, for one year after installation, of sending an electronic request to remove or disable the program.
The CRTC information bulletin 2012-548 also clarifies the contact information to be included in CEMs. A CEM that is sent on behalf of multiple persons, such as a business and its affiliates, all of the senders must be identified. Further, a mailing address setting out a valid civic address, postal box or general delivery address must be provided; e-mail addresses or URLS alone will not comply with the Regulations.