Ottawa's anti-spam proposals prohibit secret monitoring software

After more than a year of closed-door consultations, the government has finally released an updated draft proposal for those long-awaited anti-spam regulations.

The latest proposed rules, which were published in the Canada Gazette over the weekend, would add several new exemptions to the law, including inter-organizational email -- messages sent by one employee to another, for instance, or to a contractor or franchisee.

It would also expand the definition of "personal relationship," and would not apply to "the first commercial electronic message" that is sent as a result of a referral from someone with an existing relationship -- family, business, personal or otherwise -- with the recipient.

But an attempt by Canadian ISPs to garner an all-access pass that would let them secretly install software to monitor potentially illicit user activity was thwarted, at least in part.

According to the note accompanying the draft regulations, industry representatives "had argued for exemptions from the requirement for consent to install software to prevent unauthorized or fraudulent use of a service or system, or to update or upgrade systems on their networks."

Under the revised rules, service providers would only be permitted to install software "where illegal activities pose a threat to [their] networks."

In fact, the legal text goes even further than the explanatory note: it would only allow such programs to be installed "to prevent activities that the telecommunications service provider reasonably believes are in contravention of an Act of Parliament and which present an imminent risk to the security of its network."  (Note: that's an "and" not an "or", and the risk has to be "imminent," which would seem to reduce potential ambiguity.)

Consent would still be needed to install software to "prevent legal activities that are merely unauthorized or suspicious, or where an installation is not required for a system-wide upgrade or updates." 

Other new proposed exemptions:
 

• email sent to "satisfy a legal or juridical obligation," as well as provide notice of, and/or enforce "a right, legal or juridical obligation, court order, judgment or tariff" or "a right arising under a law of Canada, of a province or municipality of Canada or of a foreign state"
  
  
• email sent "by a person located outside Canada or that is sent from a computer system located outside Canada ... that relates to a product, good, service or organization located or provided outside Canada that is accessed using a computer system located in Canada .. if the person sending the message did not know and could not reasonably be expected to know that the message would be accessed using a computer system located in Canada"
  
  
• any email "sent in response to a request, inquiry, complaint or .. is otherwise solicited by the person to whom the message is sent." 

The analysis statement notes that Industry Canada received 55 submissions from "representatives of the retail, financial services, legal services, real estate, telecommunications, information technology, and general business sectors as well as public interest groups and private citizens" in response to the initial draft regulations, which were published on July 7, 2011.

Interestingly, it also acknowledges that, at press time, the government has "no specific plans for implementation, enforcement or service standards related to these particular regulations" beyond its overall anti-spam strategy.

In any case, interested parties have 30 days to submit their thoughts on the latest changes. Stay tuned!