Citing the desire for a balanced approach to the needs of individuals and organizations under Canada’s anti-spam law, the Minister of Innovation, Science and Economic Development announced today that he is delaying indefinitely the coming into force of the private right of action provisions (section 51) in Canada’s anti-spam law (CASL).
This important decision is welcome news to domestic and international businesses and other organizations subject to CASL. The private right of action had been slated to come in force on July 1, 2017 and presented a significant risk of class actions and staggering statutory damages.
Parliament is expected to further study the private right of action as part of its scheduled review of CASL to commence in 2017. It is anticipated that further amendments to CASL may be proposed to ensure that Canadian businesses are not put at a competitive disadvantage.
Information about the Private Right of Action
Under the private right of action provisions, a person who alleges that they are affected by another person’s contravention of sections 6 to 9 of CASL or section 5 of the Personal Information Protection and Electronic Documents Act in relation to the electronic harvesting of personal information, or that constitutes reviewable conduct under section 74.011 of the Competition Act(the electronic advertising provisions), may apply to a court of competent jurisdiction for an order and damages.
If a court is satisfied that a person has breached certain provisions of CASL or engaged in conduct that is reviewable under section 74.011 of the Competition Act or a breach of PIPEDA in relation to the electronic harvesting of personal information, the court may order that person to pay the applicant statutory damages (without the need to prove harm) in addition to the actual damages suffered. The statutory damages include the following:
- in the case of a contravention of the unsolicited commercial electronic message provisions (section 6 of CASL), a maximum of $200 for each contravention, not exceeding $1,000,000 for each day on which a contravention occurred (e.g., up to $200 for each email or other electronic message sent in violation of CASL);
- in the case of contravention of the software or transmission data provisions (sections 7 or 8 of CASL), a maximum of $1,000,000 for each day on which a contravention occurred;
- in the case of contravention of the electronic advertising provisions (section 74.011 of the Competition Act), a maximum of $200 per contravention, not exceeding $1,000,000 for each day on which the conduct occurred; and
- in the case of a contravention Personal Information Protection and Electronic Documents Act in relation to the electronic harvesting of personal information, a maximum of $1,000,000 for each day on which a contravention occurred..
Organizations Should Remain Diligent
Although organizations may have gained a reprieve from the private right of action, organizations will continue to be exposed to enforcement by the CRTC, the Competition Bureau and the Privacy Commissioner of Canada, including administrative monetary penalties up to $10,000,000 and potential personal liability for directors and officers. Organizations should continue to take appropriate steps to ensure that they are fully compliant with CASL. As revealed by our firm’s recent survey, many organizations are falling short when it comes to their understanding of and compliance with certain requirements of CASL – despite the fact that CASL has been in force for nearly three years. In addition, our survey indicates that organizations are not taking simple steps to reduce or even avoid liability in the event of a breach. Among other things, engaging expert legal counsel can help an organization to avoid non-compliance and establish a due diligence defence under CASL.