Industry Canada Publishes Final Version Of CASL Regulations

On December 4, Industry Canada published the final version of its Electronic Commerce Protection Regulations under the Canadian anti-spam legislation (CASL) along with a Regulatory Impact Analysis Statement (RIAS). The Regulations have undergone extensive public consultations since the first draft was issued in July 2011. CASL takes a broad approach to the regulation of commercial electronic messages (CEMs) and the installation of computer programs by creating general prohibitions against these activities unless consent is received from the affected party, subject to limited exemptions that are defined in the Act. For the most part, CASL requires that “opt-in” or express consent be obtained from an affected party, although there are certain circumstances, set out in the Act, where consent may be implied. CASL also requires that CEMs contain specified information and be in prescribed form, again subject to limited defined exemptions. The circumstances in which consent can be implied, or which are exempt from the consent and form requirements, are set out in either CASL itself or in the Industry Canada Regulations. The Regulations contain exemptions for the following categories of CEMs from the consent, information and form requirements of CASL:

• CEMs sent within an organization that relate to the activities of the organization and CEMs sent between organizations that have a relationship and concern the activities of the recipient organization. The previous version of the Regulations required that organizations have a “business relationship” rather than simply “a relationship”;
• A first CEM that is sent following a referral and where other conditions are met;
• CEMs sent in response to a request, inquiry or complaint or is solicited; and
• CEMs sent to satisfy certain legal obligations or rights.

These exemptions were carried over from the previous draft of the Regulations published on January 4, 2013. In addition, the final Industry Canada Regulations contain the following new exemptions to the CEM consent, information and form requirements:

• CEMs sent by charities and political parties in relation to fundraising efforts;
• CEMs sent on a limited-access, secure and confidential account (such as messages sent via online banking systems);
• CEMs sent on electronic messaging services if the information and unsubscribe mechanism are conspicuously published and readily available on the user interface; and
• CEMs sent to other countries that have their own anti-spam legislation and are listed in a schedule to the Regulations, which includes the US, EU, China, Japan, India and Australia.

The Regulations also provide definitions for “family relationship” and “personal relationship” (CEMs sent between individuals who have a family or personal relationship are exempt from the CEM consent, information and form requirements). The definition of “family relationship” has been changed from that included in the prior drafts of the regulations so that it no longer includes aunts, uncles and cousins. It also requires the family members have had direct, voluntary, two-way communication. Further, the Regulations set out conditions for use of consent, which are largely the same as those that were set out in the prior drafts of the Regulations. This includes a requirement that an individual who has given consent to allow third parties to send CEMs, be able to withdraw consent from all third parties in any subsequent message from any one of the third parties. The Regulations also require that the name of the original individual who obtained consent be identified in all third party messages. Lastly, the Regulations provide exceptions to the consent requirement to allow telecommunications service providers to install computer programs on its customers’ computers to either protect the security of its network or for the purpose of updating or upgrading its network. An additional exception has been added to create an exception to allow a program to be installed to correct a failure in the operation of the computer system or a program installed on it. In a later issue of E-TIPS®, we will discuss the guidance provided by Industry Canada in the RIAS. We will also discuss some of the issues brought forward by the public during the consultation process that were not addressed by the final version of the Industry Canada Regulations. Summary by: Adam Lis