Electronic Commerce Protection Regulations
Issue
Unsolicited commercial electronic messages — known as “spam” — have become a significant social and economic issue, and a drain on the business and personal productivity of Canadians. Spam now makes up over 80% of global email traffic, imposing significant costs on businesses and consumers. Spam impedes the efficient use of electronic messages for personal and business communications and threatens the growth and acceptance of legitimate e-commerce.
The growing volume of spam is a well-recognized pricing factor for companies that provide facilities for Internet services. This cost is ultimately paid for by organizations and businesses that use electronic communications for the conduct of their business. It is also paid for through the service charges paid by personal users who communicate through the Internet with family, friends and others.
In addition to imposing a cost burden, spam is now undermining the reliability of electronic message networks for business users. It also threatens consumer confidence in the online marketplace. Because of this, the potential for information and communications technology to buttress productivity and the ability of e-commerce to attract investment, create jobs, and enrich our lives are now constrained by spam.
More specifically, these Regulations address the need to provide clarity and legal certainty to some key terms used in the Anti-spam Legislation in order to effectively combat spam and related threats in Canada.
Objectives
The Anti-spam Legislation was enacted to encourage the growth of electronic commerce by ensuring business confidence and consumer trust in the online marketplace. To do so, the Act prohibits damaging and deceptive spam, spyware, malicious code, botnets, and other related network threats.
Subsection 64(1) of the Anti-spam Legislation identifies a list of matters to be addressed by the Governor in Council through regulations, particularly definitions of key terms. The objective of these proposed Regulations is to avoid legal uncertainty when interpreting key terms in the anti-spam provisions of the Act.
Description
The Anti-spam Legislation provides a clear regulatory scheme with respect to both spam and related threats from unsolicited electronic contact, including identity theft, phishing, spyware, viruses, and botnets. It also grants an additional right of civil action to businesses and consumers targeted by the perpetrators of such activities. The overall purpose of the Act is to promote the efficiency and adaptability of the Canadian economy by regulating commercial conduct that discourages the use of e-commerce by
- impairing the availability, reliability, efficiency and optimal use of e-commerce;
- imposing additional costs on businesses and consumers;
- compromising the privacy and security of confidential information; and
- undermining the confidence of Canadians in using e-commerce for commercial activities at home and abroad.
The sending of unsolicited commercial electronic messages is a violation under the Act, unless there is express or implied consent from the recipient. Exceptions include messages sent between those who have a “personal or family relationship,” and any message sent to someone engaged in a commercial activity that is solely an inquiry or application relating to that activity.
The proposed Electronic Commerce Protection Regulations include regulations under three separate regulatory powers in the Act. The first element of the Regulations stipulates that the term “personal relationship” is intended to refer only to those situations where an individual has met with the person to whom the message is sent in a non-business context, and where there is evidence of non-commercial communication between the individuals within the previous two years. In addition, the proposed Regulations define “family relationship” for the purposes of the Anti-spam Legislation to be in keeping with definitions in the Income Tax Act. It also specifies that it is intended to refer to persons descending from a common grandparent, including aunts, uncles, cousins, nieces, and nephews. Defining the meaning of “personal relationship” and “family relationship” will provide legal certainty as to which relationships will be excepted from the anti-spam provisions of the Act. The terms are clearly defined in order to establish limits and avoid legal uncertainty and ambiguity. This is necessary to prevent potential spammers from exploiting these concepts in order to send electronic messages without consent and to help legitimate businesses comply with the law.
Express consent under the Anti-spam Legislation means that commercial communication may not take place unless the person or corporation in question first consents to be contacted. Implied consent means that commercial communication may take place with persons or corporations under circumstances where it can be deemed that they might be interested, but the recipients of the communication must be able to “opt out” of such communication. The Act specifies that any commercial electronic message sent must identify the person who sent the message and the person on whose behalf it is sent, provide accurate contact information for these parties, and set out an unsubscribe mechanism.
The second element of the Regulations states that consent to receive messages from a third party is only valid if the individual providing consent will have the ability to unsubscribe to the message, and by the same means be able to alert the original requester that their consent is withdrawn. The Regulations further provide that when consent to receive messages from a third party has been withdrawn by the individual, the original requestor must notify each third party to whom the consent was provided that it was withdrawn. The purpose of the Regulations is to ensure that the person who obtains consent on behalf of an unidentified third party remains responsible for ensuring that the person who gave consent has an effective means of withdrawing consent. Specifying the conditions under which consent to receive unsolicited commercial electronic messages can be forwarded to third parties provides individuals with further control over the use of their electronic addresses. This will ultimately result in a reduction in the volume of unsolicited messages that individuals will receive.
Under the Act, implied consent is assumed in cases where there is an “existing business relationship” or an “existing non-business relationship” between the sender and the recipient. Subsections 10(10) and 10(13) provide a detailed definition of what constitutes each type of relationship. In the absence of either of these relationships, express consent must be sought for sending any unsolicited commercial electronic messages.
The third element of the proposed Regulations will provide further clarity to the meaning of “existing non-business relationship” in the Act. The proposed Regulations define “membership” as having applied for, met the formal requirements to belong to an organization, paid any fees required to belong to an organization, and having been accepted as a member in accordance with the membership requirements of the organization. The proposed Regulations define “club,” “association” or “voluntary organization” as a non-profit organization that is organized and operated exclusively for social welfare, civic improvement, pleasure or recreation or for any other purpose than profit, if no part of the income of which was payable to, or otherwise available for the personal benefit of any proprietor, member or shareholder of that organization unless the proprietor, member or shareholder is an organization the primary purpose of which is the promotion of amateur athletics in Canada. These terms must be clearly defined in order to establish limits and avoid legal uncertainty when interpreting the anti-spam provisions of the Act. This is necessary to prevent potential spammers from exploiting this concept in order to send electronic messages without consent and to help legitimate businesses comply with the law.
Regulatory and non-regulatory options considered
The Task Force on Spam considered a range of possible regulatory arrangements, including “co-regulatory” approaches, voluntary cooperation and industry peer pressure to fight spam. Ultimately, the Act responds to the Task Force’s recommendations that the government should play no role in dictating specific technical solutions, and that the legislative ground rules be technology-neutral.
Within this context, the proposed Regulations are essentially administrative in nature, and were developed under 64(1) of the Act to provide legal certainty in interpreting key terms in the anti-spam provisions of the Act. No non-regulatory options were considered for defining these terms for the purposes of implementing the Act.
Benefits and costs
Context: Estimating the costs of spam
In just a few years, unsolicited commercial messages, now generally known as “spam,” has gone from being a minor nuisance to becoming a significant social and economic issue, a drain on the business and personal productivity of Canadians, and a cloak for criminal activity. Spam impedes the efficient use of the Internet for personal and business communications, and threatens the growth and acceptance of legitimate electronic commerce. (see footnote 1)
This cost is ultimately paid for by organizations and businesses that use electronic communications to conduct their business. It is also paid for by personal users who communicate through the Internet with family, friends and others: The costs of spam fall on a wide range of actors, including
- internet service providers (ISPs) and other network operators (e.g. large enterprise users, universities, government departments), who must invest in the technical, financial and human resources needed to deploy anti-spam technologies, at the expense of investments in new or improved services, and who must allocate resources to respond to customer complaints;
- legitimate commercial e-mailers and other users of email services whose messages get filtered out by anti-spam technologies before they reach their intended recipients; and
- private and public sector organizations, whose employees waste time dealing with spam sent to their business email addresses.
Ultimately, all of these costs fall directly or indirectly on consumers and Internet end-users, who must cover the costs of fighting spam not only by purchasing Internet security software, but also by foregoing other kinds of service improvements and paying higher prices for online products.
While the overall volume of spam has risen considerably throughout the past decade, the nature of the spam threat continues to evolve. Improved filtering techniques and other anti-spam safeguards adopted by ISPs and consumers have helped to somewhat reduce the number of spam messages that are reaching the mailboxes of individual Internet users.
More significantly, there is evidence that even if the volume of traditional spam were to decline, the incidence of new threats posed by mutations of spam would still clearly be on the rise. These broader threats to Internet security include spyware, viruses, phishing and botnets, to name a few. The new mutations of spam undermine consumer confidence in the Internet as a platform for commerce and communications. Because of this, the potential of information and communications technology to buttress productivity, and the ability of electronic commerce to attract investment, create jobs and enrich our lives, is constrained not only by the volume of spam, but by the deceptive, fraudulent and malicious activities that sometimes accompany it.
According to the OECD, (see footnote 2) Internet users incur a direct cost resulting from the time spent consulting, identifying and deleting unwanted messages. In addition, they are concerned about the reliability of communications and the content of spam messages. For professional and business users, spam represents a loss of productivity, and imposes direct costs by increasing the need for technical support and software solutions such as filters. Spam imposes more general societal costs by reducing the reliability of email as a communication tool (legitimate messages can be blocked by filters or be lost among a large number of unsolicited emails), and threatening the security of a company’s internal network. The other major victims of spam are ISPs and other network operators, which process emails.
The actual cost of spam is difficult to calculate, as some of the damages are only indirect, and whether and how to value the time of private individuals is controversial. In addition, the fraudulent nature of spam, or the malware carried by spam messages, can result in more significant financial damages to users and companies. Unwanted messages create problems and additional costs to users not only in OECD countries, but also in developing and least developed economies. The latter have a less extensive Internet infrastructure, and often have relatively less available bandwidth. Individuals in developing economies often access Internet through dial-up connections, or from community access points, such as cybercafés, where the user pays on the basis of the time spent online. Under these conditions, it is easy to see how spam takes up a valuable part of the already limited resources, increases the cost of Internet access, and reduces the quality of service.
Incremental impacts of the proposed Regulations
It is ultimately not possible to quantify and monetize the full range of costs and benefits attributable to the proposed Regulations, and as such it is also not possible to take into account the broader socioeconomic benefits of the full range of elements of Canada’s new Anti-spam Legislation. However, it is worth noting that these Regulations are consistent with the principles and consent regime in the Act. The analysis will show how these proposed Regulations affect the Canadian online marketing environment.
The baseline or current situation used to assess the potential costs and benefits of the proposed Regulations are the requirements already established under the Anti-spam Legislation.
The incremental effects of the proposed Regulations, above and beyond the Act, are expected to be minimal. The Act and accompanying Regulations are expected to generate significant net benefits to Canadians by reducing the costs that spam imposes throughout the economy. The proposed Regulations are administrative in nature, adding clarity and certainty to specific sections of the Act. A brief qualitative description of the potential incremental costs and benefits of the proposed Regulations to various market participants is provided below.
Business marketing impacts
The Canadian Marketing Association (CMA) estimates the Internet marketing industry in Canada to be worth $3.3 billion in 2011 and, as a subset of that industry, the email marketing industry is worth $100 million. The Internet and email marketing industry will incur some costs and inherit some benefits with regard to these Regulations. While costs may be borne by some marketers to amend processes to comply with the Regulations, the benefits for the industry lie with consumers now knowing that messages they receive are legitimate and wanted commercial messaging.
The definitions of family and personal relationship may require Internet and email marketers to alter some of their “forward to a friend” campaigns to ensure that they are not inciting individuals to forward marketing messages to those persons who do not fall under these proposed definitions. Similarly, email list sellers and renters will have to ensure that they satisfy the new regulatory requirements dealing with informing those who are using the lists of the unsubscribe request of any individual on that list. The costs on the Internet and email marketing industry are expected to be minimal, as the proposed Regulations are consistent with industry best practices.
There may also be cost implications for social media marketers as these marketing methods rely on relationships among family and friends.
Overall, the proposed Regulations are not expected to result in any significant costs for the Internet and email marketing industry. Any front-end costs related to process changes would be defrayed by longer-term complementary benefits to the industry resulting from increased consumer trust in Internet and email marketing. Finally, the cost impacts should be minimal for these Internet and email marketers already subscribing to existing best practices, as these Regulations should require little to no change to their existing practices.
Consumer impacts
Consumers will benefit from these proposed Regulations. Personal relationship and family exceptions will mean there will be no restrictions on sending commercial electronic messages to friends and family. They will also benefit from the ease of withdrawal of consent when third parties use lists from other organizations.
Impacts on non-profit organizations
Non-profit entities including clubs, associations and voluntary organizations will benefit from the clarifications in the Regulations, as marketing to members will be accepted under the implied consent regime in the Act. This will be particularly beneficial for those entities that run contests or lotteries for fundraising purposes.
Costs to Government, implementation and enforcement
The regulatory proposal would not result in any additional costs to Government. Compliance with the proposed Regulations will be assured by the existing enforcement regime.
Rationale
These Regulations provide clarity and legal certainty regarding key terms in the anti-spam provisions of the Act. While the incremental impacts of these Regulations in terms of benefits and costs are expected to be very modest, it is anticipated that the benefits will outweigh the costs.
Consultation
These Regulations are necessary to implement Bill C-28 which was the subject of extensive consultations and debate.
Hearings were also held with interested stakeholders by the House of Commons’ Standing Committee on Industry, Science and Technology and by the Senate Standing Committee on Transport and Communications during their review of the legislation from when it was tabled in 2009 to when it was passed as Bill C-28 in December 2010.
Overall, consultations that have taken place over the past six years surrounding the legislation and the policy on which it is built have shown strong support for anti-spam regulation from consumers, Internet service providers, marketers, businesses, educators, the financial sector, legal and consumer groups, and enforcement agencies.
Implementation, enforcement and service standards
There are no specific plans for implementation, enforcement or service standards related to these particular Regulations beyond the overall plans of the Government for effective implementation of the Anti-spam Legislation. Some of these broader efforts related to implementing the Act include a “Fight Spam” Web site, a 1-800 help line for Canadians, a spam reporting centre, education and awareness campaigns, as well as training of compliance and enforcement personnel.
Contact
Bruce Wallace
Director
Electronic Commerce Policy
Electronic Commerce Branch/SITT
Industry Canada
Telephone: 613-949-4759
