Anti-Spam Legislation: Coming Soon to a Campus Near You?
On December 10, 2010, Parliament passed Bill C28, Canada’s anti-spam legislation (with an impossibly long name1 shortened here to the “Act”). Although the Act is not yet in force, it is expected that it will be proclaimed in force in 2013 once final regulations are in place.
The Act is not limited to preventing wide-scale or mass-market spam messages as it will apply to the sending of any commercial electronic messages (“CEMs”), including email messages. It creates a consent regime, and requires that senders include particular content and a clear opt-out mechanism.
The Act will apply to electronic messages sent with a purpose of encouraging participation in “commercial activity”. This is defined in a very broad fashion to mean “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, whether or not the person who carries it out does so in the expectation of profit, other than any transaction, act or conduct that is carried out for the purposes of law enforcement, public safety, the protection of Canada, the conduct of international affairs or the defence of Canada.” The Act specifically includes advertisements or offers to provide a gaming opportunity.
For public postsecondary institutions, it is not clear whether their core educational or research activities would be considered “commercial activity”, although such a finding is unlikely. However, other activities outside of the traditional core of post-secondary activities, such as the sale of goods, may be more likely to fall within the concept of “commercial activity”. Government commentary on the Act does state that charities using email are not subject to the Act unless the communications relate to such commercial activity as selling or promoting a product.
There are three general requirements that must be met in order to comply with the anti-spam provisions in the Act: identification requirements; consent requirements; and unsubscribe requirements.
First, CEMs must identify the person who sent the message and (if different) the person on whose behalf it is sent, including the provision of accurate contact information.
Second, the Act requires express consent from recipients prior to the sending of a CEM, subject only to limited exceptions. Express consent may be obtained orally or in writing, including by use of electronic forms. Consent may be implied in certain circumstances, including in relation to existing business relationships and defined nonbusiness relationships. However, the Act contains limitations on the time frame for reliance on existing relationships. The Act also requires notice that consent may be withdrawn by the recipient.
Third, CEMs must include a clear and prominent unsubscribe mechanism, such as by way of reply email or other simple means. The recipient’s choice of the unsubscribe option must be given prompt effect.
In addition to the anti-spam provisions, the Act contains limitations regarding certain types of online commercial activity, including prohibitions on unauthorized installation of computer programs, misleading electronic communications, and unauthorized harvesting of email addresses. The Act includes large fines for failure to comply and also permits a private right of action for those persons affected by non-compliance.
1“An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radiotelevision and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act”