FIGHTING INTERNET AND WIRELESS SPAM ACT OR LET S HOPE THIS BILL STICKS

Transcription

1 FIGHTING INTERNET AND WIRELESS SPAM ACT OR LET S HOPE THIS BILL STICKS ALEXANDRE C. ARCHAMBAULT * ROBIC, LLP LAWYERS, PATENT AND TRADE-MARK AGENTS Introduction In 2007, the online marketplace was already an important segment of the Canadian economy with $62.7 billion in sales. In 2010, the worldwide electronic commerce is expected to exceed $9.6 trillion. 1 However, the evolution of the way business is done comes with new opportunities for scammers and fraudsters. Canada is currently ranked 4 th worldwide as a source of spam 2 and nearly 90% of s sent around the globe are considered to be spam 3. Indeed, most of us have certainly experienced frustration at the sight of inboxes filled with unwanted junk and scams. Bill C-28 was introduced in the House of Commons on May 25, 2010 by the Honourable Tony Clement, Minister of Industry, to address these issues. 4 As he himself said, this bill intends to deter the most damaging and deceptive forms of spam from occurring in Canada and to drive spammers out of Canada. CIPS, * Lawyer with ROBIC, LLP a multidisciplinary firm of lawyers, patent agents and trade-mark agents. The author wishes to thank Simon Picard, articling student at ROBIC, LLP, for his valuable research and contribution to this article. Publication Industry Canada, News Release, Government of Canada Moves to Enhance Safety and Security in the Online Marketplace (25 May 2010), online: [Industry Canada]. 2 We re still going to get spam The Globe and Mail (22 January 2010), online: The Globe and Mail < 3 Industry Canada, supra note 1. 4 Bill C-28, An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act, 3 rd Sess., 40 th Parl., 2010 (as first read by the House of Commons 25 May 2010) [Bill C-28].

2 2 Bill C-28 has only passed the First Reading stage in the House of Commons, but it might be placed on the fast track since it is in fact an old bill that died on the order paper when Parliament was prorogued by the Conservative Government. That old bill was Bill C-27 of the second session of the 40 th Parliament, originally introduced in April Bill C-27 had actually been passed by the House of Commons and had passed the second reading in the Senate. It was close to receiving Royal Assent. C- 28 being essentially the same as the old C-27, it is easy to understand that it might receive Royal Assent faster than usual. Indeed, the name of the Act has been changed from Electronic Commerce Protection Act to Fighting Internet and Wireless Spam Act (hereinafter the Act ), but the substance remains mostly the same. We will review the main prohibitions, the enforcement mechanisms and will outline along the way some of the changes and practical impacts this bill could have in Canada. Prohibitions There are three main prohibitions that relate to: 1) sending of commercial electronic messages; 2) phishing scams; and 3) spywares and botnets. The prohibition against commercial electronic messages is found at section 7(1) of the Act and reads as follows: It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied. Firstly, it is important to realize that this prohibition only applies in respect to a commercial electronic message. Such a message is defined to cover any content, hyperlink or contact information that makes it reasonable to conclude that one of the purposes of the message is to encourage in participation of a commercial activity. 5 As such, the distinction made is not between unwanted and demanded communications, 5 Ibid., cl. 2(2).

3 3 which would certainly be a difficult line to draw, but between commercial and noncommercial communications. It will therefore not reduce the amount of unwanted chain letters, for example, one might receive. Secondly, this provision applies to a wider scope of communication than only computer generated s. This is due to electronic address being very broadly defined to cover accounts, instant messaging accounts, telephone accounts and any similar account. 6 Thirdly, this prohibition covers the whole range of persons that might be involved in the sending of infringing communications: the person or entity that actually sends it, the one that causes it to be sent and the one that permits it to be sent. However, for this prohibition to take place there must be a link to Canada: either a computer system in Canada is used to send the message or a computer system in Canada is used to access it. 7 Certainly businesses will be interested in the requirements to send communications to their customers legally. There are two main requirements: form and consent. In regards to the form, the message being sent must identify the sender or the person on whose behalf it is sent. It must include information enabling the receiver to contact this person and finally it must include a mechanism for the receiver to be able to unsubscribe. 8 Consent is the subject of multiple exceptions, but generally it must either be express or implied. One of the first exceptions is if there is a personal or family relationship. 9 These terms would be defined in future regulations that would accompany this legislation, but it would certainly cover someone sending a message of a commercial nature to a friend, such as someone sending an to his list of contacts that he has furniture for sale or someone sending a hyperlink to a friend of a commercial website. Another important exception is when a commercial message is sent to a person who is engaged in a commercial activity and it consists of an inquiry or 6 Ibid., cl. 2(1). 7 Ibid., cl. 13(1). 8 Ibid., cl. 7(2). 9 Ibid., cl. 7(5)a).

4 4 application in relation to that activity. 10 This may actually cover many communications sent from businesses to prospective business clients if the inquiry relates to their field of activity. Another important exception is for product recalls, warranty information and security or safety information. 11 Other types of communications are also excluded: two-voice communication, facsimile and voice recording. 12 Thus, we see that this legislation is only intended to apply to electronic messages and not to telemarketing or fax communications. Express consent can be obtained by clearly setting out the identity of the person seeking consent and the purpose of the consent. 13 Implied consent, on the other hand, is subject to multiple provisions. Consent will be implied of an existing business relationship between the sender and the recipient. 14 Such a relationship includes having purchased a product, good or service over a two-year period preceding the communication. It also includes an active contract plus a two-year period following the end of that contract. A simple inquiry, on the other hand, will imply an existing business relationship for a six month period. 15 This means anytime a good, product or service is purchased and the company has the personal information of the buyer, it can start spamming the buyer on the basis of an implied consent, until that customer opts-out through the unsubscription mechanism. Consent can also be implied from an existing non-business relationship. This exception will cover a two-year period after a donation or gift is made to a registered charity, political party or candidate. Volunteer work and membership generally, as that term will be defined in the regulations, also permit the sending of commercial messages for a two-year period following termination Ibid., cl. 7(5)b). 11 Ibid., cl. 7(6)c). 12 Ibid., cl. 7 (8). 13 Ibid., cl. 11(1). 14 Ibid., cl.. 11(9). 15 Ibid., cl. 11(10). 16 Ibid., cl. 11(13).

5 5 The next prohibition, contained in section 8 of the proposed Act, is the anti-phishing provision. Firstly, phishing is defined as the sending of a fraudulent electronic communication that appears to be a genuine message from a legitimate entity or business for the purpose of inducing the recipient to disclose sensitive personal information. 17 The Act speaks more generally in terms of "altered transmission data" in a message that is delivered to a recipient other than specified by the sender, but this covers phishing type activities. 18 Some exceptions are allowed: if the alteration is made with the express consent of the sender or recipient, or under a court order. 19 The third main prohibition is the "anti-spyware and botnet" provision included at section 9 of the Act. A spyware is a "software that is installed in a computer without the user's knowledge and transmits information about the user's computer activities over the Internet" 20, while a botnet is "is a large number of compromised computers that are used to create and send spam or viruses or flood a network with messages as a denial of service attack." 21 These activities are countered by prohibiting, without express consent or court order, the installation, in the course of a commercial activity, of a computer program on any other person's computer system. 22 "Computer program" is defined by incorporating the definition contained at s (2) of the Criminal Code: "data representing instructions or statements that, when executed in a computer system, causes the computer system to perform a function". 23 This makes the provision broad enough to cover spyware and botnet type activities, but raises the questions of whether it is in fact too broad and may cover beneficial activities. Enforcement 17 Black s Law Dictionary, 9 th ed., s.v. "phishing". 18 Micheal Geist, The Electronic Commerce Protection Act - The Spam Prohibitions (24 April 2009), online: Micheal Geist < 19 Bill C-28, supra note 4 cl. 8(1). 20 Merriam-Webster Online: s.v. spyware, online: < 21 PC Magazine Encyclopedia: s.v. botnet, online: < 22 Bill C-28, supra note 4 cl. 9(1). 23 Ibid., cl. 2(1).

6 6 Enforcement of this new Act is made through a private right of action, which allows a person to recover damages suffered by the violation of the Act, 24 but mainly through the Canadian Radio-television and Telecommunication Commission (hereafter "the Commission"). 25 The Commission is given broad investigation powers, including: the power to demand a telecommunications service provider to "preserve transmission data", 26 the power to require individuals to produce documents, 27 and the possibility to obtain ex parte warrants to enter premises and verify compliance with the Act. 28 Once a violation has been established, the Commission may obtain an "undertaking" which corresponds in practice to a settlement 29 or it may issue a "notice of violation", after which the person notified may make representations before the Commission. 30 The Commission may impose in its decisions penalties up to $1 million for individuals and $10 million for any other person. 31 The Commission s decisions may be appealed to the Federal Court of Appeal. 32 Conclusion Certainly, this new Bill, if passed, cannot make it worse than it already is, but how much will it help? It will depend partly on the regulations that will accompany this new Act, but we believe people generally may not see as drastic a difference they might be expecting, in light of the "implied consent" provisions. The fact is also that a lot people sign up for newsletters and give their s every time they are asked for it, without reading the fine print, which might involve giving or selling their information to 24 Ibid., cls Ibid., cl Ibid., cl. 16(1). 27 Ibid., cl. 18(1). 28 Ibid., cl Ibid., cl Ibid., cl Ibid., cl. 21(4). 32 Ibid., cl. 28.

7 7 "affiliates". In the end, a lot of the spam we receive may actually fall under the definition of consensual and therefore may go untouched by this Act. ROBIC, un groupe d'avocats et d'agents de brevets et de marques de commerce voué depuis 1892 à la protection et à la valorisation de la propriété intellectuelle dans tous les domaines: brevets, dessins industriels et modèles utilitaires; marques de commerce, marques de certification et appellations d'origine; droits d'auteur, propriété littéraire et artistique, droits voisins et de l'artiste interprète; informatique, logiciels et circuits intégrés; biotechnologies, pharmaceutiques et obtentions végétales; secrets de commerce, know-howet concurrence; licences, franchises et transferts de technologies; commerce électronique, distribution et droit des affaires; marquage, publicité et étiquetage; poursuite, litige et arbitrage; vérification diligente et audit. ROBIC, a group of lawyers and of patent and trademark agents dedicated since 1892 to the protection and the valorization of all fields of intellectual property: patents, industrial designs and utility patents; trademarks, certification marks and indications of origin; copyright and entertainment law, artists and performers, neighbouring rights; computer, software and integrated circuits; biotechnologies, pharmaceuticals and plant breeders; trade secrets, know-how, competition and antitrust; licensing, franchising and technology transfers; e-commerce, distribution and business law; marketing, publicity and labelling; prosecution litigation and arbitration; due diligence. COPYRIGHTER IDEAS LIVE HERE IL A TOUT DE MÊME FALLU L'INVENTER! LA MAÎTRISE DES INTANGIBLES LEGER ROBIC RICHARD NOS FENÊTRES GRANDES OUVERTES SUR LE MONDE DES AFFAIRES PATENTER R ROBIC ROBIC + DROIT +AFFAIRES +SCIENCES +ARTS ROBIC ++++ ROBIC +LAW +BUSINESS +SCIENCE +ART THE TRADEMARKER GROUP TRADEMARKER VOS IDÉES À LA PORTÉE DU MONDE, DES AFFAIRES À LA GRANDEUR DE LA PLANÈTE

8 8 YOUR BUSINESS IS THE WORLD OF IDEAS; OUR BUSINESS BRINGS YOUR IDEAS TO THE WORLD Trade-marks of ROBIC, LLP ("ROBIC")