On March 9, 2017, the Canadian Radio-television and Telecommunications Commission issued a Compliance and Enforcement Decision imposing a $15,000 penalty on an individual for violating Canada's Anti-Spam Legislation by sending commercial electronic messages without consent from the recipients and without prescribed formalities.
CASL
Canada's Anti-Spam Legislation (commonly known as "CASL") creates a comprehensive regime of offences, enforcement mechanisms and potentially severe penalties (including personal liability for employers, corporate directors and officers) designed to prohibit unsolicited or misleading commercial electronic messages ("CEMs"), the unauthorized commercial installation and use of computer programs on another person's computer system and other forms of online fraud (such as identity theft and phishing).
For most organizations, the key parts of CASL are the rules for CEMs. Subject to limited exceptions, CASL creates an opt-in regime that prohibits the sending of a CEM unless the recipient has given consent (express or implied in limited circumstances) to receive the CEM and the CEM complies with prescribed formalities (e.g. including sender information and an effective and promptly implemented unsubscribe mechanism) and is not misleading. An organization that sends a CEM has the onus of proving that the recipient consented to receive the CEM.
CASL violations can result in potentially severe administrative monetary penalties (up to $10 million per violation for an organization and $1 million per violation for an individual) in regulatory enforcement proceedings, civil liability for compensatory damages and potentially substantial statutory (non-compensatory) damages in a private action by a person affected by a CASL contravention (commencing July 1, 2017) and vicarious liability on employers, directors and officers who are unable to establish that they exercised due diligence to prevent CASL contraventions.
The Canadian Radio-television and Telecommunications Commission (the "Commission"), the Competition Bureau and the Office of the Privacy Commissioner of Canada have enforcement responsibility under CASL, and have various enforcement tools for that purpose (e.g. preservation demands, production notices and warrants).
The Compliance and Enforcement Decision
The Decision related to three email campaigns, between 8 July and 16 October 2014, by William Rapanos advertising a design, printing and distribution service for commercial flyers. Over 50 complaints to the Spam Reporting Centre resulted in an investigation that included notices to produce documents issued to Rapanos and to various third parties (e.g. internet and mobile phone service providers and landlord). The investigation resulted in the issuance of a notice of violation to Rapanos setting out a $15,000 administrative monetary penalty ("AMP") for 10 CASL violations – sending CEMs without the recipient's consent, without prescribed information identifying the CEM sender or providing the CEM sender's contact information and without a required unsubscribe mechanism.
Rapanos disputed the notice of violation. He claimed that someone else sent the emails and asserted that he could not afford to pay the AMP. Rapanos also argued that the case against him had not been proven beyond a reasonable doubt in violation of the Canadian Charter of Rights and Freedoms. The Commission rejected Rapanos' arguments and upheld the notice of violation. The Commission found, on a balance of probabilities, that the emails violated CASL, that Rapanos was responsible for the emails because they issued from his home internet connection and there was no credible challenge to the evidence implicating Rapanos, and that the $15,000 AMP was appropriate.
CASL Burden of Proof
The Commission held that the Charter right to be presumed innocent until proven guilty beyond a reasonable doubt did not apply to CASL proceedings because they are not criminal proceedings. The Commission explained a designated investigator may issue a notice of violation if the investigator has reasonable grounds to believe a CASL violation was committed. The Commission also explained that if a person applies to the Commission to review a notice of violation, then the Commission's decision regarding the alleged violation is based on a balance of probabilities.
Administrative Monetary Penalty
CASL states that the purpose of an AMP is to promote CASL compliance, and not to punish. CASL lists the factors to be considered when determining the amount of an AMP. The Commission commented on those factors.
- Purpose: The Commission explained that the purpose of an AMP is to promote CASL compliance and not to punish, and that the amount of an AMP must be commensurate with the nature of the non-compliance and must serve as a deterrent for future non-compliance. The Commission held that a $15,000 AMP was large enough to deter future CASL violations by Rapanos but was not so large as to preclude him from continuing to market services online in a lawful manner.
- Nature/Scope of Violation: The Commission held that each of the three email campaigns resulted in multiple CASL violations that caused disruption to the recipients. The Commission reasoned that Canadians have a reasonable expectation that they will not receive unsolicited CEMs that lack prescribed information. The Commission found that Rapanos was indifferent as to whether his emails complied with CASL and to the nuisance his emails caused to Canadians.
- Ability to Pay: The Commission repeated previous guidance that an assertion of inability to pay an AMP must be supported by detailed documentation. The Commission gave little weight to Rapanos' claim of inability to pay because the claim was not supported by any evidence.
- Other – Lack of Cooperation: The Commission explained that Rapanos' failure to fully cooperate with the investigation (e.g. incomplete response to notice to produce and attempt to prevent the investigator from speaking with relevant witnesses) was a relevant factor to the amount of an AMP.
- Other – Self-Correction: The Commission explained that self-correction and future compliance with CASL were relevant factors to the amount of an AMP. The Commission held that Rapanos' stated intention to comply with CASL was not sufficient because the statement was not supported by evidence of compliance efforts. The Commission also noted that Rapanos had continued his email campaigns in violation of CASL after he was first made aware of the investigation, and continued to deny involvement in any of the impugned email campaigns.
For those reasons, the Commission concluded that a $15,000 AMP was proportionate to the circumstances and was reasonable and necessary to promote CASL compliance.
Comment
CRTC's decision provides insight into CRTC's approach to assessing AMPs for sending CEMs in violation of CASL's consent and formalities requirements. CRTC's previous enforcement actions have resulted in penalties ranging from $1.1 million to $48,000. For more information see BLG Bulletin – CASL Enforcement Decision – Sending Messages Without Consent (October 2016) and BLG Bulletin – CASL Year in Review (January 2017).
Commencing July 1, 2017, persons affected by a CASL contravention will be able to invoke a private right of action to sue for compensation and potentially substantial statutory damages. Organizations should assess their CASL compliance and prepare to respond to CASL lawsuits by reviewing and updating their CASL compliance program. For more information see BLG Bulletin – CASL Compliance Programs – Preparing for Litigation (October 2016).
