Introduction to the UEM Ordinance and the Regulation

Transcription

1 Industry Briefing on the Unsolicited Electronic Messages Ordinance Introduction to the UEM Ordinance and the Regulation Henry Chang Office of the Telecommunications Authority July of 16

2 Regime, Scopes and Exemptions 1. Opt-Out regime 2. Electronic messages Pre-recorded voice/video message; Fax Short messaging Others 3. Commercial in nature Offer, advertise or promote goods, services, business opportunities etc. 4. Hong Kong link Send from or to Hong Kong 5. Exemptions Listed out in Table 1 and Table 2, such as person-to-person interactive calls 2 of 16

3 Phased Implementation first phase on 1 June 2007 Prohibition of professional spamming activities, i.e. to use unscrupulous ways to reach out to more recipients for the sending of commercial electronic messages (Part 3 s.14-20), such as 1. Supply, acquisition and use of address harvesting software or lists* 2. Automated means to generate electronic addresses (dictionary attack, brute force attack)** 3. Automated means to register for five or more addresses**** 4. Use of open relays/proxies*** Fraud and other illicit activities related to the sending of multiple commercial electronic messages (Part 4 s.21-26) such as 1. Hacking to machines 2. Use of zombies 3. Falsify machine-generated header information 4. Deception of source addresses 5. Falsification of headers information (CLIs, IPs etc.) * for the sending of commercial electronic message with a Hong Kong link and without the consent of the recipients ** for the sending of commercial electronic message with a Hong Kong link *** for the sending of multiple commercial electronic messages with a Hong Kong link **** for the sending of multiple commercial electronic message with a Hong Kong link and without the consent of the recipients 3 of 16

4 Phased Implementation - Second phase around the end of the year Provisions about rules to be observed by senders of commercial electronic messages (Part 2 s. 8-13) 1. Provision of accurate sender information 2. Provision of unsubscribe facilities 3. Honouring unsubscribe requests 4. Honouring the do not call registers 5. Not using misleading subject headings in commercial messages 6. Not withholding CLIs in calls Launch of the do not call registers (s ) 1. Pre-recorded calls 2. Faxes 3. Short messaging 4 of 16

5 UEM Regulation The UEMR relates to: s. 8 (1) (c) [accurate sender information] s. 9 (1) (c) [unsubscribe statement] s. 9 (1) (d) [unsubscribe facility] of the UEMO: Key provisions are: S.5/UEMR what constitutes sender information S.6/UEMR language requirements on sender information S.7/UEMR language requirements on unsubscribe facility S.8/UEMR Order of information in a call S.9/UEMR Electronic channel for the unsubscribe facility 5 of 16

6 Penalty for Contravention Prohibition of professional spamming activities, i.e. to use unscrupulous ways to reach out to more recipients for the sending of commercial electronic messages (Part 3 - s.14-20) [OFTA to enforce] Summary conviction a fine up to level 6 [and in some cases, imprisonment up to two years] Conviction on indictment a fine up to HK$ 1M and imprisonment up to five years. Fraud and other illicit activities related to the sending of multiple commercial electronic messages (Part 4 s.21-26) [Police to enforce] Conviction on indictment a fine of no limit and imprisonment up to 10 years. Provision of rules to be observed by senders of commercial electronic messages (Part 2 s. 8-13) [OFTA to enforce] OFTA to issue enforcement notice for senders to put right malpractices Contravention of the enforcement notice First conviction a fine up to level 6 Subsequent conviction a fine up to HK$ 0.5M and a daily fine of HK$1,000 6 of 16

7 Existing Regulatory Frameworks - CoPs Codes of Practice (CoPs) on the handling of unsolicited promotional calls generated by machines Service provider may terminate senders phone lines if two or more complaints are substantiated within five days Not-to-Call list for fax advertisement Weekly updated in OFTA s web site Consumers register to the list via their service providers Code of practice exists for operators to handle complaints against fax advertisers Service provider may terminated all fax service if two or more complaints are substantiated within five days Unsolicited promotional inter-operator short messages 7 of 16

8 Industry Briefing on the Unsolicited Electronic Messages Ordinance Relevance of the UEMO and UEMR during a marketing campaign Henry Chang Office of the Telecommunications Authority July of 16

9 A Simplified Marketing Campaign Flow* Preparation Target recipients (s. 15, 16, 17 and 18) Contents preparation (s. 8, 9 and 12) Sending Sender Identity (s. 19, 25 and 26) Technical infrastructure (s. 13, 18, 20, 22, 23 and 24) Do not call register (s. 11) Response Management Unsubscribe facilities (s. 9 and 10) The examples and scenarios in this entire briefing are simplified cases for illustration purpose only, they would not prejudice OFTA s future interpretation of the UEMO and any possible enforcement actions. 9 of 16

10 Preparation Target recipients (s. 15, 16, 17 and 18) Concerning the supply (s.15), acquisition (s.16) and use (s.17) of address harvesting software and lists Make sure recipient lists are not obtained from using address harvesting software Use of automated means to generate recipients electronic addresses (s.18) Contents preparation (s. 8, 9, 12) Make sure message must have reachable accurate sender information note also s. 5, 6 and 8 of the UEMR Make sure message contains functional unsubscribe facility and statement note also s. 7, 8 and 9 of the UEMR message must not have misleading subject heading 10 of 16

11 Sending Sending Identity (s. 19, 25, 26) Must not use automated means to create multiple accounts (throw-away accounts) Must not register for multiple or domain names using falsified information Must not falsely represent to be the registrant of multiple addresses or domain names Technical infrastructure (s. 13, 18, 20, 22, 23, 24) Must not withhold CLI in calls Must not automatically generate recipient electronic addresses Must not use open relay/proxy to retransmit CEMs No hacking of systems to send CEMs No deception of source addresses in CEMs No falsification of headers information (CLIs, IPs etc.) 11 of 16

12 Sending Do not call registers (s. 11) Must check do not call register unless valid consent has been obtained from registered users of electronic addresses Priority of consent, unsubscribe request, DNC Three DNCs fax, short messaging, pre-recorded calls How the public can register to the DNC How businesses can register and access the DNC to cleanse their databases Formats of the DNC files How often to check the DNC Must honour newly added electronic addresses in the DNC within 10 working days 12 of 16

13 Response Management Unsubscribe facilities (s. 9, 10) Records of unsubscribe requests to be retained three years (s. 9 (3)) Honour unsubscribe request within 10 days (s. 10 (2)) 13 of 16

14 Other Scenarios Assuming meeting all three criteria of (1) electronic (2) commercial message (3) with a HK link Promotion activities after business card exchange Preparation (Target recipient) - Is harvesting software used? Preparation (Contents) Must follow rules required for the sending of CEMs; Sending (Identity, Technical infrastructure) Sending (DNC) - Honour Do-Not-Call register (if available) unless consent has been obtained from registered user of electronic addresses; Response Management (Unsubscribe facilities) Others - PDPO consideration List renting/purchasing Must ensure the list is not harvested/automatically generated; Liability between a company and its marketing agency/employer and employee s.59 Liability of principals, agents, employers and employees practicable steps to prevent s.60 Liability of directors and partners showing evidence that one did not authorise the act The mobile phone Missed calls trick If you do not reply to this message, we will assume that you have consented 14 of 16

15 Exemptions Exemptions Non-commercial, non electronic or without a Hong Kong link such as not being a commercial message Table 1 of Schedule 1 such as person-to-person interactive calls Item 1, Table 2 of Schedule 1 such as web browsing Item 2 to 4, Table 2 of Schedule 1 such as to complete a transaction, product recall notices With consent from the registered users of the electronic addresses Scope from which exemption applies The whole UEMO The whole UEMO within a reasonable time, to be exempted from part 2 of the UEMO Part 2 of the UEMO The Do Not Call Registers 15 of 16

16 - The end - 16 of 16