Ralph Kroman is a business lawyer with WeirFoulds LLP. He helps his clients deal with intellectual property and technology matters such as the acquisition of information technology and the licensing and protection of copyright, trademarks, and confidential information. Recently, he sat down with me to talk about Canada’s new anti-spam legislation.
MARK BORKOWSKI (MB): What is Canada’s new “Anti-Spam” law?
RALPH KROMAN (RK): Canada passed the Fighting Internet and Wireless Spam Act, unofficially referred to as the “Anti-Spam Act,” in December of 2010. It has not yet entered into force, but once it does, likely sometime in 2013, it will regulate certain activities to deter damaging and deceptive forms of spam, and will ultimately promote the efficiency of our economy by prohibiting electronic threats to commerce.
MB: How will this new law impact Canadians and how they run their businesses?
RK: The Act will have a significant impact on Canadians and their businesses, specifically regarding how they handle electronic means of conducting commercial activities. For instance, the main application of the Act relates to electronic messages sent to encourage participation in a commercial activity, including the purchase of goods or services by the recipient. These are referred to as “commercial electronic messages” and include messages sent through email, social networking sites, and text messages. Individuals and businesses are prohibited from sending these messages without the consent of the recipient, identification of the sender and corresponding contact information, and inclusion of an unsubscribe mechanism.
Even if you send a single electronic message targeted to one individual, it may be subject to the Act. So, businesses will definitely want to review this law now in order to prepare for compliance.
MB: In addition to sending commercial electronic messages without consent, what other activities are prohibited by the Act?
RK: Some of the other prohibitions involve the installation of computer programs without express consent; the alteration of transmission data resulting in electronic messages being delivered to a different destination without express consent; the use of false or misleading representations online in product or service promotions; and the collection of personal information and electronic addresses through computer programs without permission.
The full list of prohibitions can be found at fightspam.gc.ca.
MB: How will implied consent be monitored as we transition to the Anti-Spam Act?
RK: Once the Act comes into force, we are given a transitional period where the consent of a person who has an existing business relationship is implied only until he or she either retracts consent, or until three years after the day the Act has come into force, whichever is earlier.
MB: What happens if someone, whether an individual or a business, is caught violating the Anti-Spam Act?
RK: With respect to violations involving the absence of consent, there is a reverse onus obligation where, if investigated, you must be able to prove that you obtained consent, express or implied.
There are serious implications and penalties for violating the Act. Individuals can be fined up to $1 million per violation, while entities, such as corporations, can be fined up to $10 million per violation.
MB: How can Canadians and businesses protect themselves from these implications?
RK: Compliance is the key to protection, and awareness and preparation are needed for compliance. Review the regulations, understand them, and take the necessary steps to ensure you comply.
Look at your electronic communications and determine which ones would be classified as commercial electronic messages and be caught by the Act. Then, review your database of contacts and determine where consent is required for future communications.
You will also want to establish procedures for obtaining express consent, for maintaining lists of recipients who fall under implied consent, and for removing recipients when implied consent expires.
Finally, make sure all communications comply with the Act and include all requisite information and the unsubscribe mechanism.