Industry Canada unveiled regulations on Wednesday, providing greater detail on how companies will be required to control the way they send commercial messages to Canadians.Getty Images/iStockphoto
Canada's new anti-spam law has been finalized and will come into effect next summer.
Industry Canada unveiled regulations on Wednesday, providing greater detail on how companies will be required to control the way they send commercial messages to Canadians.
The law aims to crack down on spam and other "electronic threats" such as phishing (communications that take on the guise of a legitimate business and ask people for sensitive information) and spyware (software that gathers data such as a person's Internet browsing habits, personal information, etc.). According to Industry Canada, this type of activity costs the Canadian economy an estimated $3-billion a year.
Starting July 1, 2014, companies will be required to follow a new set of rules when it comes to communicating via e-mail, text message and mobile application.
The final regulations come nearly three years after the bill was signed into law, following extensive consultations with the marketing industry.
The new rules state that companies are allowed to send messages only to consumers with whom they have an existing business relationship – for example, if someone enters a contest on a website, checks a box asking for company news, or asks to be informed when an out-of-stock item becomes available. When people consent to receive messages from a company, their e-mail addresses go into that company's marketing database.
When the law was first announced, many businesses were concerned they would have to reobtain consent for every person in those databases. Instead, previous consent to contact a customer will carry over.
"That's a big win for us," said John Gustavson, president and CEO of the Canadian Marketing Association, an industry group that represents marketers across the country. "… It would have been a huge expense."
Under The Personal Information Protection and Electronic Documents Act (PIPEDA), there is a provision for implied consent – allowing communications if a business has sold that person something in the past, and if the business is not using sensitive personal information. The new regulations will allow businesses to use implied consent at first, but by the summer of 2017 they will have to switch over to communications with explicit consent only.
All electronic messages must offer an option under the regulations to unsubscribe from a company's communications. Registered charities are exempt, as are political fundraising e-mails during elections.
The final regulations also address another business concern, that communications and computer programs sent to other countries might still have to comply with the Canadian law, which is more restrictive than many other regions.
Some business leaders argued this would put Canadian companies at a competitive disadvantage overseas. The regulations will now allow businesses to follow the laws of each jurisdiction; Canadian law will apply in countries where no anti-spam legislation exists.
"Our government does not believe Canadians should receive e-mails they do not want or did not ask to receive," Industry Minister James Moore said in a statement. "These legislative measures will protect consumers from spam and other threats that lead to harassment, identity theft and fraud."
The new regulations have not addressed all concerns, however.
Some have raised concerns that it may be difficult for businesses to prove that they have a qualifying "existing business relationship" with the consumers on their email lists. Since PIPEDA's standard has focused mostly on giving people the chance to opt out from receiving commercial messages, not all companies may have retained the information they will need. "We've got this disconnect between what the new law requires and what organizations have done in terms of building their mailing lists," said Michael Fekete, a partner and co-chair of the Technology Group at law firm Osler.
He also said the regulations on computer programs could hamper technology in Canada. "[The law] goes further in regulating a broad scope of activities than spam or spyware laws in other jurisdictions," he said. "… Given that technology is developed for a global marketplace, and that software is increasingly in all devices, many of which are wirelessly connected, there are concerns that the legislation could impede the ability to update existing programs."
The Canadian Chamber of Commerce expressed concern on Wednesday about the cost associated with complying with the new regulations. Building in an unsubscribe function for messages and keeping a verifiable database of people who have given consent to receive messages are common for most large companies but less common for small businesses.
"It's the cost of compliance versus the benefit back to the economy and back to society. Our members don't want spam, but they don't want to spend thousands of dollars to prevent spam," said Scott Smith, director of intellectual property and innovation policy at the organization. "The reality is, most of the bad spammers don't reside in Canada. Really what you are doing is taxing Canadian businesses for the problem that may or may not be solved."
Canada's anti-spam law is focused on regulating "commercial electronic messages." But the digital messages most of us see most often – banner ads online, many of which are targeted to each user personally based on Internet browsing activity and other behavioural data – don't count.
This may seem a curious distinction to some, since even though banner ads do not show up in an email inbox, they are speaking to consumers in an increasingly individualized way.
"It has to be a more proactive sending of the message – text, email, mobile applications. There's a fairly wide net," said John Gustavson, president and CEO of the Canadian Marketing Association. "Yes, you may see ads that are more relevant to you, as a result of this behavioural – we like to call interest-based – advertising, but because it is not proactive, it is exempted from the Act."
Behavioural targeting in online ads is for now a self-regulatory issue for the ad industry. In September, the Digital Advertising Alliance of Canada (DAAC), which represents most of Canada's largest advertisers and ad agencies announced that they had joined a global program to regulate those ads. The program is designed to inform consumers about how their Web activity is tracked, and to provide an opt-out mechanism for targeted ads.
The "Ad Choices" icon – a blue triangle with an "i" inside it – has begun appearing on Canadian digital ads to let consumers know that those ads are targeted based on their browsing behaviour. Clicking on the icon lets people opt out of that targeting (though it does not prevent people from seeing ads altogether.)
"The Internet is funded primarily by advertising," Mr. Gustavson said. "That's something we need to keep reminding people."
According to research from the Office of the Privacy Commissioner of Canada, 92 per cent of Canadians think that user consent should be required for companies to do Internet tracking.