Trudeau government shelves part of anti-spam law that would allow private lawsuits
Provisions to allow Canadians to sue spammers had been due to take effect July 1
Prime Minister Justin Trudeau's government is being accused of caving to big business lobbying after it decided to indefinitely freeze application of part of Canada's anti-spam law that would have allowed ordinary Canadians to sue for spam.
University of Ottawa law professor Michael Geist, who was part of the task force whose report led to the anti-spam law, is "highly critical" of the government's decision to stop the law's private right of action provisions from going into effect as scheduled on July 1.
- Bell breach may have exposed over one million new email addresses to phishing and spam
- Gmail users warned of phishing email with malicious link
"There is no way to interpret this as anything other than a major victory for the business lobby groups like the chamber of commerce and the marketing association whose lobbying, I would say, has been relentless against the legislation."
Geist said the provisions would not only allow Canadians to sue spammers, but it could allow Canadians who have been victims of ransomware to try to recover the money they may have had to pay to recover their computer files.
Marketers feared 'frivolous lawsuits'
Wally Hill, vice-president of government and consumer affairs for the Canadian Marketing Association, said that three government agencies are already enforcing the anti-spam law. His members were concerned that the provisions allowing Canadians to sue spammers could lead to a multiplication of lawsuits.
"The private right of action, in terms of protecting consumers from spam and in terms of incenting organizations to obey the law, is unnecessary," he said in an interview with CBC News.
"It was simply going to provide an avenue for frivolous lawsuits that would really just end up costing the economy and business and consumers at the end of the day."
Hill and Dan Kelly, president of the Canadian Federation of Independent Business, say they are hoping an upcoming review of the anti-spam law will result in even more changes.
A spokesperson for Navdeep Bains, minister of innovation, science and economic development, said the minister was concerned that the private right of action provisions would have led to "unnecessary red tape and costs" for Canadian businesses.
"Protecting consumers and businesses is a priority for our government," Karl Sasseville said in a statement. "Canada's current Anti-Spam Legislation (CASL) protects consumers and businesses from spam and other threats, such as malware, that lead to identity theft and fraud."
"However, there have been various businesses, technology and not-for-profit organizations that have expressed concerns with the Private Right of Action provisions of the act."
Sasseville said the government has asked a parliamentary committee to review the anti-spam law.
Private lawsuit provision suspended indefinitely
Canada's three-year-old anti-spam law was adopted by Parliament in 2010, but much of the law only went into effect in 2014.
The private right of action provisions were only scheduled to go into effect on July 1, nearly seven years after the law was first adopted. However, in early June the government adopted an order-in-council, indefinitely postponing the right of action provisions.
Under Canada's anti-spam law, those who send commercial electronic messages without a recipient's consent — including to social networking accounts and text messages to cellphones — can be hit with stiff fines.
The government estimates spam costs Canada's economy $3 billion a year.
The law also includes provisions that prohibit false or misleading representations online, harvesting email addresses without consent and installing computer programs on somebody's computer without their consent.
Three government bodies are charged with enforcing various parts of the legislation: the CRTC; the Competition Bureau; and the Privacy Commissioner's Office.
Since the anti-spam law went into effect, the CRTC alone has received more than 975,000 complaints from Canadians, Steven Harroun, chief compliance and enforcement officer, told a Toronto audience earlier this month.
A number of companies have already been fined or forced to pay penalties in the three years the law has been in effect.
- In March 2015, the CRTC fined a Quebec company, 3510395 Canada Inc., known as Compu-Finder, $1.1 million for spamming Canadians in 2014. In 2016, the CRTC fined Blackstone Learning Corp. $50,000 for sending unsolicited emails in 2014.
- Other cases have been settled through undertakings on the part of the companies involved. For example, in November 2015. Rogers Media paid $200,000 for sending out emails that did not include an unsubscribe mechanism, and in June 2015 Porter Airlines agreed to pay $150,000 for sending out emails that did not clearly feature an unsubscribe option and to people it could not prove had consented to receive its emails.
- Plenty of Fish Media Inc., an online dating site, paid $48,000 after it sent emails that didn't have an unsubscribe function that could be readily performed.
- In August 2016, Kellogg Canada reached an undertaking with the CRTC that included a $60,000 payment after Kellogg or its third-party service provider sent emails to Canadians without their consent.
The Competition Bureau has hit three prominent companies under the anti-spam law with seven-figure penalties for misleading representations online.
- In June 2016 it announced Avis and Budget rental car agencies would pay a $3-million penalty after the bureau concluded that discounts they advertised online were misleading. In April 2017, it was Hertz and Dollar Thrifty that agreed to a $1.25-million penalty for "advertising unattainable prices and discounts."
- In January 2017, Amazon agreed to change its online pricing practices and paid $1.1 million to settle the case with the Competition Bureau.
Geist said the CRTC and other government departments are enforcing the anti-spam law, but their efforts are "a drop in the bucket" compared with the barrage of spam that hits Canadians.
"They are doing what they can, but there's a limit to what they're able to do, and if we take a look at what the private right of action has the potential to do — in a sense it is crowd-sourcing potential enforcement actions — particularly against well-known spamming organizations. So you might have the public come together to seek compensation."
In the United States, which has a private right of action provision, big companies like Microsoft have used it to deal with spammers who were spoofing their identify online and launching phishing attacks, Geist said.
Geist said he is concerned that those who lobbied the government to shelve the private right of action provisions of the law will turn their attention to the government's planned review of Canada's anti-spam legislation.
Businesses want more change to law
Kelly said the Canadian Federation of Independent Business was "delighted" when the government postponed implementation of the right to sue spammers and is hoping the upcoming review will lead to more changes.
"There is still a lot of bad stuff within the anti-spam legislation that we feel is still in need of change, but this aspect was probably the most troubling and the fact the government has put the brakes on that part is certainly good news from our perspective."
While the anti-spam law risks hitting businesses, Kelly questioned whether it stops the worst spammers.
"The real issues of true spammers that are out there trying to trick you into something or spread some sort of virus, we believe that the existing legislation will be hopelessly ineffective given that happens internationally."
"Bad guys are already breaking so many existing rules doing this, they're not going to worry about Canada's anti-spam legislation, even if they are domestic."
Elizabeth Thompson can be reached at firstname.lastname@example.org